Extracted

• • Target

    927a17384bd553dddaeb039356c39db0

  • Size

    29KB

  • MD5

    927a17384bd553dddaeb039356c39db0

  • SHA1

    71bf39ac9de7d8e2893d1be49272b14e5cceea44

  • SHA256

    79ef0af209534be6df3ab0a37f6a7478b7fc1b3a23db49e755b228e7dabb1ea8

  • SHA512

    72ba382312758ded30079510d78708595ca66f36fc865a9d71a6b2b1facc5663d2a070a0cd5e77d746505ccef4fdcc2d766890a3560be2765746e6ca67581040

  • SSDEEP

    768:2N8fWlfoQmQAXV7E/QciiRcrHKOu3SqqK:WMNXFl76Nnd

  Score

  10^/10

  miraiunstbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20595) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1