Extracted

• • Target

    77e61b9fbbe097a47bc2cfd7907b9b01

  • Size

    47KB

  • MD5

    77e61b9fbbe097a47bc2cfd7907b9b01

  • SHA1

    e579323dc45416da4c366b7a8ebcf31861795d19

  • SHA256

    121877d33210299a5e0f8f46a3fbd99ff2637b3de940392928317af3ff988143

  • SHA512

    1c13681589e43953d0fafc2a48361137317c266828137a42d0f9566dad689cfaad87f48fbe22cf7550438016ad5af7b2dfbd0a785421579e65a3c91731cad7f9

  • SSDEEP

    768:QzHjH7qV0sr/ayZRQOSLYCzA2v2HJwqK5dsgdn8cwT+v6kJJOJhAK7KBC5PDyW9y:MjHehREdA2Wyn3rd8cSREKwC5Dw

  Score

  10^/10

  miraikytonbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (142806) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Changes its process name

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1