Extracted

• • Target

    df4144d4e15eb528cbb3d62896cb3bb4

  • Size

    29KB

  • MD5

    df4144d4e15eb528cbb3d62896cb3bb4

  • SHA1

    bc1b8bc0edcc4be0cf01d24dce9549316dc95fa6

  • SHA256

    53e43078220f164963ca7aa648fb981e7f39e34c6b26d98eaf8148e8070d11c9

  • SHA512

    2b658b113e52e6c148e55e8b50d3e2d423a04949797a31bfd9c68cffc0677b57efd3557beb87af570658a03e4de7edbdd4f8fa1e46b02342e3e894cdda60f021

  • SSDEEP

    768:ad9c3tP8gJHcHMHygJT+lk30vmOhLX8o0jfXXs3Uozy:gEpdJMyIue/Mpj/Kzy

  Score

  10^/10

  mirailzrdbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20428) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1