Extracted

• • Target

    26913fb9e3478836f7ce89e4e2a29c78_JaffaCakes118

  • Size

    30KB

  • MD5

    26913fb9e3478836f7ce89e4e2a29c78

  • SHA1

    22578bf400cc6336ce22a915aaeeb86c3fad834a

  • SHA256

    12ab7ef93a2945151cffa26210f6e939c5ea966178ba4413ed6b6adcb4bb5737

  • SHA512

    186404e8f6656b0a4f40477916c8f6ff57901507f1797c08b61fba3b7dbead9076399097b04880eae5610f01b7c4f349889f7a1392afa0665b1d234c73878eef

  • SSDEEP

    768:oHEfFF4xYasK7S6weygSVwVOzeMV8xtPdTInbcuyD7URQRjp:oUFbaXbweygSVwsVIddEnouy8RyN

  Score

  10^/10

  mirailzrdbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20724) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1