Extracted

• • Target

    0aae1fc8f3e0f085e1877cd3e2961a69

  • Size

    29KB

  • MD5

    0aae1fc8f3e0f085e1877cd3e2961a69

  • SHA1

    a310964bf44bf03edc809e46069ac954c4f3dbdc

  • SHA256

    27cca51ab59ab8c1c827ac0ffbd3101c16c096f5b1934e217d02e162aa65186d

  • SHA512

    f3216a23ca4365659d7b536b827e929fb0c13b1710eb03eef999b81cc04cc4c4b5c704c02c5c873ff23678074d6c90e556bb014e7f8b8704cc616ab42e839840

  • SSDEEP

    768:CVCKdGS7YGSv25mR12ZBz3EG2lJnJgGlzDpbuR1Jo:CVCHtvdSvzeVJu2

  Score

  10^/10

  mirailzrdbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20198) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1