Extracted

• • Target

    9188ba937c7c02f7537ebbc103efffa6

  • Size

    28KB

  • MD5

    9188ba937c7c02f7537ebbc103efffa6

  • SHA1

    9def26a31403a3bfa6d5b4466f185fd45a491d2d

  • SHA256

    8f576eca72a51fb533491b99a64f2d77d36edc7c90f8598439c7cfe4622e87ff

  • SHA512

    a1e3b712f208e7381c05b9c44e6e60b7f9852496307cc4a2220e553bd02899d86f776a9325da50a0a6072b814fed49f243528fbe03af7126c723eb3e60b4526b

  • SSDEEP

    768:pCpuAWk6DWclA4xC9lQg0uq0xm/jiggzVVMRr:gpD/OWl4xDL0xm/ezVCr

  Score

  10^/10

  miraimiraibotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (40953) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1