Extracted

• • Target

    e037dd203b458d0d59684e2154efc8b5

  • Size

    29KB

  • MD5

    e037dd203b458d0d59684e2154efc8b5

  • SHA1

    95ba15e1ce1a3577fb03c99eeb3b29df5c85f729

  • SHA256

    9af511d1ca0efbca71c1f396c92a2406b9413d4228b5ff346e22549d92a06f63

  • SHA512

    187ed782dcd91eddea75acfdf53cdb3593cd1e2be487432e4cb07fa60b2555a00e6cd1960bf5be130a5a4128631128806b50000959ffd464dce9069efff07b60

  • SSDEEP

    768:xN8fWlfoQmQAXV7E/QciiRcLprDKTJazqg:jMNXFl76N4PCm

  Score

  10^/10

  mirailzrdbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20366) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1