Extracted

• • Target

    654d0db4e11b68e52681c446a7204d0f

  • Size

    29KB

  • MD5

    654d0db4e11b68e52681c446a7204d0f

  • SHA1

    16b013f7901415fea5e0e8dfa79a17481cc10dd5

  • SHA256

    75551c06091e1d4047e685d89d0e1d373a6fee134292783c48c7cbf30d97ff0b

  • SHA512

    478fd5e767087fc3eb1b43525aef027fa2546209c9c8bc50dc581f6dd66892a2a4c42a6c36e226ebd44a2bb47e2df78873dd30668b07bbe2065c7ec38aa14f45

  • SSDEEP

    768:wA4uBc0T/nVvqV072G+IFYoXHZCx3Gges3UozI:wPuB7/nVMYn+Kf5GDzI

  Score

  10^/10

  mirailzrdbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (19887) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1