Extracted

• • Target

    866611f6d37edd487020453db2fddf3c

  • Size

    29KB

  • MD5

    866611f6d37edd487020453db2fddf3c

  • SHA1

    1afd783b4cae08088ba752e6e03ac74efac206be

  • SHA256

    9f886266ff6c639968b512b8483ce2f4715455200bd567e2d64a728b0079b73c

  • SHA512

    4d5100c3bf8bdf416a5ee5ce1d440f2aa939fcb5fd25d230d407ad947b9e363985a8091d55d770b90d0ffe455866052cdd9b1765f0845f95317e494d2f55176f

  • SSDEEP

    384:MeMzN8f05Rpjk5Yfo2xZUTKmQAHHOvgm0vtsgV7EmQi3iDeGFXmLc1/Z3/e8Ummj:EN8fWlfoQmQAXV7EmQciiRcrHKOu3YqN

  Score

  10^/10

  miraiunstbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20523) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1