Extracted

• • Target

    c519dd235e502439bcea7f69a8afcf75

  • Size

    21KB

  • MD5

    c519dd235e502439bcea7f69a8afcf75

  • SHA1

    20bbdd69bff4ef122773393b3b4270c4bb959073

  • SHA256

    b1ae3b7ff52115dc2208aa97c31e84cf96f73252fbc2a0e35508af041d96e4e1

  • SHA512

    5f3c182dc2a34bd983a75fdd5a2ae72c5684e60313bfb7e9b627b0f49b6c713a95bca3c1636bf74a4e24a02df592aa6b723d8fd5eed61ecd2e39e6fce121de16

  • SSDEEP

    384:MiX206yHsN1bGmfVtcekttoUz6iISkwyHYdQ/ACPbyxK3Nycz:l2/Wmfk1toorpyHjDbyxJw

  Score

  10^/10

  miraiunstbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (69428) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1