Extracted

• • Target

    6236dba79664f2ba6ebcf8b2010a50ae_JaffaCakes118

  • Size

    27KB

  • MD5

    6236dba79664f2ba6ebcf8b2010a50ae

  • SHA1

    c12b07294333be48145225a506710e970743d16c

  • SHA256

    ea609c19b15f709b6e543337cf040439064f30424c0841ad46473986f4e069e0

  • SHA512

    da29a0a9c4a7b348d44f330cf9c40fd7d696d0db511d13002b5f222eaac07ffa70d7e2666253e855ff25bdcfc7a72324d868c58552190c6761a305a7d57e953a

  • SSDEEP

    768:Ao/su//JOqvstwXbo/XaBQ7V+KsmnbcuyD7UHQRjj:Ao/suuwroSyJMmnouy8HyX

  Score

  10^/10

  miraimiraibotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20524) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1