Extracted

• • Target

    50c846e0b105f591368cc5edb9ba9dbe_JaffaCakes118

  • Size

    26KB

  • MD5

    50c846e0b105f591368cc5edb9ba9dbe

  • SHA1

    856a3018b032da0a4cfebf8006b21586a4af2a12

  • SHA256

    09306ec7f18b2af1d5195e19b54b87cb5c9a6c8735b2f0e141166309c26148f6

  • SHA512

    edb83985b946bde8e3d55963d2e7652096527e0e1df6f124394518b3baac9e014fcb983985ece5d324b5b2b470494152ae043802b6d61deb41e1af3c449d1a48

  • SSDEEP

    384:M58mFBN67XgygoBMAyvcuTvmwpkS6Yk9T8i9IkDxA9oFEx700H/xUZdf5iVT6i4o:c8mFB5RAyvxTvPkS6aiTqSZdCGML

  Score

  10^/10

  mirailzrdbotnetdiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20502) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1