General
-
Target
d1a6abf2766bfa165828fa5b26ce06b7
-
Size
107KB
-
Sample
231220-sgdkdsdge9
-
MD5
d1a6abf2766bfa165828fa5b26ce06b7
-
SHA1
61c32cd7e9f64d0bce402c11540e8bbab44492fc
-
SHA256
570446a84f151173578455067b6abff9d20fbd20530c5e8277b3c1c4ebc6a0a7
-
SHA512
7359e3b9d831b910efc62a2ab5520b1548f1f81d69214f88cc5072ec19ac38caef2061b37cde3042d2ee8d625dd1cb2b9941c8ed83a3a022b6911232586e9526
-
SSDEEP
3072:ReNX2SozVJb+WgzX16CfRaQIkQCxuM+XD/M/9ARmqXO7:ReNX2SeyFF6CfRaQINCV+XLM/9uDO7
Behavioral task
behavioral1
Sample
d1a6abf2766bfa165828fa5b26ce06b7
Resource
debian9-armhf-20231215-en
Malware Config
Extracted
mirai
LARRY
xd.botnet.services
meow.botnet.services
Targets
-
-
Target
d1a6abf2766bfa165828fa5b26ce06b7
-
Size
107KB
-
MD5
d1a6abf2766bfa165828fa5b26ce06b7
-
SHA1
61c32cd7e9f64d0bce402c11540e8bbab44492fc
-
SHA256
570446a84f151173578455067b6abff9d20fbd20530c5e8277b3c1c4ebc6a0a7
-
SHA512
7359e3b9d831b910efc62a2ab5520b1548f1f81d69214f88cc5072ec19ac38caef2061b37cde3042d2ee8d625dd1cb2b9941c8ed83a3a022b6911232586e9526
-
SSDEEP
3072:ReNX2SozVJb+WgzX16CfRaQIkQCxuM+XD/M/9ARmqXO7:ReNX2SeyFF6CfRaQINCV+XLM/9uDO7
Score9/10-
Contacts a large (53619) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Writes file to system bin folder
-