Extracted

• • Target

    0c4c5a18c8baf4403526cf546f239c55_JaffaCakes118

  • Size

    30KB

  • MD5

    0c4c5a18c8baf4403526cf546f239c55

  • SHA1

    3f8aaa74f8fa5c5e84204616e8771edd28896ceb

  • SHA256

    a7b6c71697bf97163ac938c6a1fa2d5e053fb48c3e0e54d4c4ac25eb469ee60a

  • SHA512

    19285d9f47498bbf603a81e6399b7b8b0324b8722c2cf4c0c135cf8596dbbe464367921d4c5c965f649cea27a4d62c868cee58551192c9f8e0834722b38b61a5

  • SSDEEP

    768:2yvYLznDEB2iC+sDqC6NtxsfzxPnNsGbpTX2JgGlzDpbuR1JH:xYnnDEBI+smATfp2VJuN

  Score

  10^/10

  mirailzrdbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20793) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1