Extracted

• • Target

    983eef929d1bf5d2e9ba347cbc18bcbc

  • Size

    52KB

  • MD5

    983eef929d1bf5d2e9ba347cbc18bcbc

  • SHA1

    2802df3edf0331e3db21d8637a888c5b688e3de2

  • SHA256

    3da4a95ba542bd1488716db2d13b4d087b3ca8c5fb21b154b5ff2cb7c6275273

  • SHA512

    6e6018280f71037de782c07c962b5fa5cdb63e66baadbf501bd68303b7f8e89a7d3d98c5ad499b2876e52e0623ea2823e78858449ed3df49f83b64e0634c5337

  • SSDEEP

    1536:wvfyZF83ujA+bj2ju1y/5LSVaMMYj8xJmI:JZFzjlKuw5L0aMMYj8xJJ

  Score

  10^/10

  miraiunstbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20551) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1