General
-
Target
1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118
-
Size
35KB
-
Sample
240626-q6gx1axdqc
-
MD5
1234a7ab6996aea4b3d2e344ea102d81
-
SHA1
5b6f469940856194a1ed9c933d67e2f91df7ff44
-
SHA256
62ed5a5e76d64384e85b59acb063773ebcbb542d978b5e3bfc811a7ff5a000e2
-
SHA512
5ad8afa0b6b13d17a3ae09a6b969712a1a6c61497b8273912fffd1073c7bfb4fba776b190e15b592312643361f0f3720c5ca21b4afcac8c394c4a36988546b75
-
SSDEEP
768:Gk1Ad+hrTxdXhyT1vSjCXnaOfk2xNS8UFr7YuEtHga7nZA3Us:Gk1AdGrTxdXh4vSjCXaV22vYTAa7nY
Static task
static1
Malware Config
Extracted
mirai
KYTON
Targets
-
-
Target
1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118
-
Size
35KB
-
MD5
1234a7ab6996aea4b3d2e344ea102d81
-
SHA1
5b6f469940856194a1ed9c933d67e2f91df7ff44
-
SHA256
62ed5a5e76d64384e85b59acb063773ebcbb542d978b5e3bfc811a7ff5a000e2
-
SHA512
5ad8afa0b6b13d17a3ae09a6b969712a1a6c61497b8273912fffd1073c7bfb4fba776b190e15b592312643361f0f3720c5ca21b4afcac8c394c4a36988546b75
-
SSDEEP
768:Gk1Ad+hrTxdXhyT1vSjCXnaOfk2xNS8UFr7YuEtHga7nZA3Us:Gk1AdGrTxdXh4vSjCXaV22vYTAa7nY
-
Contacts a large (112291) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Writes file to system bin folder
-