Extracted

• • Target

    6e322ba167316d02775a32147a2df025

  • Size

    106KB

  • MD5

    6e322ba167316d02775a32147a2df025

  • SHA1

    09f2e69c59ed39927f06fbb5e82c08de2884ef77

  • SHA256

    396d6e5525f7f839ba2d3aadcbde3780f3ca820ce352d3e2939397352231c201

  • SHA512

    9105bd86e149528301e8142c28c43f24376b78fc34a291df0b033fae316b007683352db1db51b1ae5061ae722313ac27c800f0b6a959efab54cef9f2f98c34dc

  • SSDEEP

    3072:DaD5O6WpUhrHn3LkPPNXZ5O11Romqo4cqH2JnQ2T:DaDuybn3g9e11Romqo4cqH2JnQ2T

  Score

  9^/10

  discovery

  • Contacts a large (176105) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Changes its process name

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

  behavioral1