Extracted

• • Target

    df9029eea6e3e51c3c06794d79b60bbd_JaffaCakes118

  • Size

    32KB

  • MD5

    df9029eea6e3e51c3c06794d79b60bbd

  • SHA1

    c955c0d007efa292dc3d49cf0b613d44a778dd85

  • SHA256

    ca6de8164cf49b1b7745ca66286f4b4259876ab832d31cc8b301fef49bf7fb2b

  • SHA512

    84ec97ab46fefdc49a070768f776f6266f02d17cd454114fbfd2bc1d5ea93794e9a84251d854112e6a2a75ad8ad73b37c0957cf29705bf8585bbdbaa9b6ddc69

  • SSDEEP

    768:HbzFTnOXHVDQnkZRBCKnZc9VSZ18FYqXjvPBT7fhMFmt9cjJgGlzDpUYsz:HbzZOtwklZ185XjvPlHPcZVqYI

  Score

  10^/10

  miraiunstablebotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (95512) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1