Extracted

• • Target

    f4169417ebf372c33932c844452d3829_JaffaCakes118

  • Size

    27KB

  • MD5

    f4169417ebf372c33932c844452d3829

  • SHA1

    a0fbe525c8acd322dc10975277c7000246d02129

  • SHA256

    ad2ba0c97023cf23a69452dd1acf913da132db4f4a64b48ebc13d76ccbe3fe5b

  • SHA512

    77de96df5cf1ebfb22e44baa951e527d632c86760536cdcbcf13064ce9b1de0e0d02715c658f9a157f4535b81ba45e3f6d6fe7a98ccc191037fe4c5aac16acbf

  • SSDEEP

    768:DD/su//JOqvstwXbo/XaBQ7V+GqvGnbcuyD7UHQRj4:DD/suuwroSyJJQGnouy8Hys

  Score

  10^/10

  miraimiraibotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20491) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1