Extracted

• • Target

    69a26df7a618a6cef3098f40ef2f9913

  • Size

    31KB

  • MD5

    69a26df7a618a6cef3098f40ef2f9913

  • SHA1

    8ff96579348f47abf6cb72598151847df28b85d7

  • SHA256

    e3cf3679fb9b880c4e1aa41b53619d6cb559945aebcf25f35752059938190c38

  • SHA512

    61909f2d20460c48740f758ec23af41755d480eb0ad31e89640631c2e46d06d5706f1ad3268e9fa22a5adbe84e524e7fc50ee8d72fc381315a8ac5e156be4d36

  • SSDEEP

    768:DL6y1JlHo+YXU1IxDqxNvkQC/oKfd2B9x16jNbJx+POK1s3Uozg:Ph5uhDqvvkX/oKsduYZ4zg

  Score

  10^/10

  miraimiraibotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20438) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1