Extracted

• • Target

    e80061af37aa728eb1ab1f8e0b75517b_JaffaCakes118

  • Size

    52KB

  • MD5

    e80061af37aa728eb1ab1f8e0b75517b

  • SHA1

    9936a98147ff22cefd59f73c45f208b6a9b579a7

  • SHA256

    61e72921103f4ed5efacfdc6239febf5ac52238a078020ead4e3cd5ce394dc1c

  • SHA512

    75852770ce1a9c5e86854e857e5bd8b9e9e4e50a2ffe6b67b092d4a36e12697855038c39392b7c631525aa2f060f2be60821340364c49c1ba3759636d963b63d

  • SSDEEP

    1536:+Y3AmUi3ML4EkwjIQV5WW+PTlL9FtLV2xourV:/753lWI+5P+PBLLtR2Fx

  Score

  10^/10

  miraimiraibotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20706) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1