Extracted

• • Target

    664f2dd196b3923a64a1fcd04ed03ff0

  • Size

    52KB

  • MD5

    664f2dd196b3923a64a1fcd04ed03ff0

  • SHA1

    134377d70fecba028e0ef131e95dbd6b19093649

  • SHA256

    181518226c9bb5c7fd67f6134949e686ec6d59f92c038022e6a18d2964955562

  • SHA512

    4aaeeab56d4f329ed1392d929951fc09b4283763084234777f37317430018f1eee48300e45b662fce68a96d83ce93a5918dc8dfae6fafda9d1a96363b9a1a72e

  • SSDEEP

    768:0kmvf0FtZtFN82wOL8UA+bjJ4ju4hFbDRqDy/X9q3UELxuXs2KwRq/izzV6W:IvfyZF83ujA+bj2ju1y/mLlwRq/0zL

  Score

  10^/10

  miraiunstbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20048) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1