Extracted

• • Target

    e860f1c1b54f65d9ed7b33ac2667be82_JaffaCakes118

  • Size

    30KB

  • MD5

    e860f1c1b54f65d9ed7b33ac2667be82

  • SHA1

    83fdb55c932dda4cda6b1e38dfc887834044b6c7

  • SHA256

    dfc734b0a57c7470433e5b5fc7323abba59afbc86508e167a1f44179ef455afd

  • SHA512

    ba1f877a2ff50e6b8855b1dbc9b1b53ffda3e86d1738f0da4cb3aee8a3b90aa0d9bd371c24257ae3f801acbb184881274b8e5f3c347839f2ad7a3cb0f8e7edf7

  • SSDEEP

    768:dyvYLznDEB2iC+sDqC6NtxsfzxPnNsGbAz4XIJgGlzDpbuR1Je:4YnnDEBI+smATfm7VJu0

  Score

  10^/10

  mirailzrdbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (19881) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1