Extracted

• • Target

    ed15fe96aacb11526c0d7ac235d911b7_JaffaCakes118

  • Size

    30KB

  • MD5

    ed15fe96aacb11526c0d7ac235d911b7

  • SHA1

    fe6f2e6f9f6dcc2ac258739620c21cd5ca60ede9

  • SHA256

    d3d0e2c3cf9ad27571f8ada96eff15fbd3ff8ca1d05425db5442df34a00153ed

  • SHA512

    6a3e99d912bcdfd6c51e91432a7e7c5b5d6603640a8b5587792b2c076618d4e81079236eb2e0c5517df99ac79eb1115ddf08341f829377fe4e0b43db8d9d5ac1

  • SSDEEP

    768:/yvYLznDEB2iC+sDqC6NtxsfzxPnNsGbUOhjsKXAJgGlzDpbuR1Ju:GYnnDEBI+smATfnjmVJuI

  Score

  10^/10

  mirailzrdbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20144) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1