Extracted

• • Target

    a97af67e89678ae9195e7ac9e39b25af

  • Size

    29KB

  • MD5

    a97af67e89678ae9195e7ac9e39b25af

  • SHA1

    b30f4fed47d5e93e96ad05a8398da8a3b4ab7c8c

  • SHA256

    5c207f50f97402b44042f8780ede2beabea08db3b870b76735afa8e2fd64c617

  • SHA512

    fdedbf0918efd224c02458be169d873b91328dd1e68b244825e3fd1156f3ef65b44139fd59f8be00e7f259bbbc2d1daa61e6c2a3f19967b06cb60bc415fd7292

  • SSDEEP

    768:C2v1lsdixHq7Wu2PDG4rFct/+VyRYWsrQYWtZZvOthZecKjb2tVKiI:Lv1lHuW/xrFyVRWQvZWzKjbGFI

  Score

  10^/10

  miraiflashbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (81643) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Changes its process name

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder

  behavioral1