Extracted

• • Target

    fd17ed2d5d6d8e5af5efc40f69aedd9b_JaffaCakes118

  • Size

    26KB

  • MD5

    fd17ed2d5d6d8e5af5efc40f69aedd9b

  • SHA1

    0c72088855a2e87ec4322fcd541f4e0a221fbcb1

  • SHA256

    b5ae62543376a42b15924bd02bfcdbb1b432fd90639b38903ce2aed66c4373c3

  • SHA512

    d510106b33df7cf7a24dd371abd1f728f7e9ae92867d146ed0910eee5c084dfcc4287e6a78e11376dbd3483c106d835c6642fd0da77034846ddbed7de6e921f5

  • SSDEEP

    384:ME8mFBN67XgygoBMAyvcuTvmwpkS6Yk9T8i9IkDxA9oFEx700H/xUZdf5pDf45dD:p8mFB5RAyvxTvPkS6aiTqSZdHDfrE

  Score

  10^/10

  mirailzrdbotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20522) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1