Extracted

• • Target

    f876edfc5f8bc2c805459053cde8e5e9_JaffaCakes118

  • Size

    29KB

  • MD5

    f876edfc5f8bc2c805459053cde8e5e9

  • SHA1

    b985673430ea2cdda45ae4bb4ab46a1a3178ae94

  • SHA256

    7421df23c004f41ef51d8f651de6c0e32ffe69f8c1bbd114845400ae4a6b6e24

  • SHA512

    32c5d03eaa9449f76d00a8bd63d053eceaaa0197c90382bdeb6a02df3a971ff1c09b769e278330f5d224c6fe45645318338d6b9235736238d3e308349c3fc424

  • SSDEEP

    768:jJj09dy2kPlqjX+xBjj+eAoahvGX1Gs3Uoz3:peoAZGX1rz3

  Score

  10^/10

  miraiunstbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20395) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1