General
-
Target
5dc4058081bfd47b71a62b4e180407cf_JaffaCakes118
-
Size
54KB
-
Sample
240520-ht8wyshd7s
-
MD5
5dc4058081bfd47b71a62b4e180407cf
-
SHA1
33c59c9758ae88612a97a1846058fa9b7bd86cd0
-
SHA256
ab10d59a0b53cf2ceafc0dde68c361538f53f6c870375230060dd9104ecb2e5b
-
SHA512
b88b07d63f4e1fb22e08038a5ac1b59b70ddd4868de234dbc9a21a81b4b96fd7dbc286c72e7a51e2431303230f421c393140ae673ee1b92e21d103a9a577056e
-
SSDEEP
768:wctW5eWYK3IPHjD2b7BKPJ1NB/TTfBPJfFaHb7W4dzZ7eOYxc39o:wYWYK3CHjDC7wPjNB3fs77WizZ7elxc
Behavioral task
behavioral1
Sample
5dc4058081bfd47b71a62b4e180407cf_JaffaCakes118
Resource
ubuntu1804-amd64-20240508-en
Malware Config
Extracted
mirai
MIRAI
air.sinushost.biz
stone.sinushost.biz
Targets
-
-
Target
5dc4058081bfd47b71a62b4e180407cf_JaffaCakes118
-
Size
54KB
-
MD5
5dc4058081bfd47b71a62b4e180407cf
-
SHA1
33c59c9758ae88612a97a1846058fa9b7bd86cd0
-
SHA256
ab10d59a0b53cf2ceafc0dde68c361538f53f6c870375230060dd9104ecb2e5b
-
SHA512
b88b07d63f4e1fb22e08038a5ac1b59b70ddd4868de234dbc9a21a81b4b96fd7dbc286c72e7a51e2431303230f421c393140ae673ee1b92e21d103a9a577056e
-
SSDEEP
768:wctW5eWYK3IPHjD2b7BKPJ1NB/TTfBPJfFaHb7W4dzZ7eOYxc39o:wYWYK3CHjDC7wPjNB3fs77WizZ7elxc
Score9/10-
Contacts a large (24627) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Deletes itself
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-