Extracted

• • Target

    996346bd5f745b04bf002a06c84f9eff

  • Size

    30KB

  • MD5

    996346bd5f745b04bf002a06c84f9eff

  • SHA1

    1ea276d83d3a4cc987cb6665b81eb27ed7426b86

  • SHA256

    f43c60c8cbc6cad66ca469b8a0286175b46305962eae56361edb75bb8c819fec

  • SHA512

    c463defa39a93478e1ebd03ed2ec80d179602f17edf28e07da35626f177bcf71bec067318cb6e18595b2a831bd32c388b36aebe1c2308bc52731417d460c6015

  • SSDEEP

    768:StgA1D2W295qfPSh5Dl6yLepzwAdQwEs3UozG:YWXqSh1qpxhzG

  Score

  10^/10

  mirailzrdbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20666) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1