Extracted

• • Target

    520ec309d6b80914fa9b7e97b82b383e_JaffaCakes118

  • Size

    31KB

  • MD5

    520ec309d6b80914fa9b7e97b82b383e

  • SHA1

    74de1d593df5c3cc52c01f25b1e3292bedcf2f13

  • SHA256

    9f4327c669ce8b3f64dcef2a666c3a9107d2e5569893fd1757ebe7d2ad1298d9

  • SHA512

    27c03e93f65627418370dac7642f566b426c03ab71d36e23b5738d6a4ffd47aeacf7392bc76a6c32dcccdb11356def93f155e3b654e11d70004523c4e1830634

  • SSDEEP

    768:0nZwAmfH/GbCDJCD9Ea8byWqK4udlB7Nrt+nJ7DpGJgGlzDpbuR1Ju:0n6AsH/GmDwBJ8byWqKD7JO7DQVJuE

  Score

  10^/10

  miraimiraibotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20150) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  behavioral1