Extracted

• • Target

    6827b11f34bce4c3b194fbce1f06905a

  • Size

    57KB

  • MD5

    6827b11f34bce4c3b194fbce1f06905a

  • SHA1

    964cd36d95bfe9360ad7798c9d5f46ab33c7a383

  • SHA256

    93dd0d57a7e084efb45bc6e86d735be31b4e3cd9e82be2b5f67778e590c39757

  • SHA512

    00100ce8e761da6035a062161b7419cff364cac0e6ed871ec0b6381b0a2a07d9afc4ebffc737d4460a294d851c8c54508f45fdc46765aaaa2734457fa5b11290

  • SSDEEP

    1536:z31pQFYz6zD9ukn1urJtK3uCz7IY2I6obpXL:xaFYz6wknYrJE+CYYZ6obVL

  Score

  9^/10

  discovery

  • Contacts a large (931563) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Changes its process name

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1