Extracted

• • Target

    65f3e8cc5ff1e36293f067866424d754

  • Size

    30KB

  • MD5

    65f3e8cc5ff1e36293f067866424d754

  • SHA1

    e1eee4c3041ecdd8f2e0281c91c7071e1f34e1bf

  • SHA256

    a9292dabc30ce9bfcf9edcc61ad8f3f40256917a6368eec9845b66c610a5fd2c

  • SHA512

    f3ee0ba2bf42821bc4765830eddd4ffd29a8df3455dda5b4b1e32daa08d5623c5ced9ad5943a6364139f935bac8c042f3a53190d0c731a6f90d699b7960b775f

  • SSDEEP

    384:eACtY2JghN20yhzC5K03AA3vOjCEi2UDTea/j+HoSBwax42asfHnped1zWVQXW+7:eJVChN20yp0lUeDaa/l4425Bej7WI

  Score

  10^/10

  miraimiraibotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (19813) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  behavioral1