Extracted

• • Target

    cdc130e3e77b9d6eb7ebab73ab074da9_JaffaCakes118

  • Size

    71KB

  • MD5

    cdc130e3e77b9d6eb7ebab73ab074da9

  • SHA1

    2f6e7ce2ad9a51b12afbe332afff1fde74f229fd

  • SHA256

    78f5ba004a0f385eaf6a26b0b56c4facf7a0a61d5c513c68d6243512def18166

  • SHA512

    b70ad5c01cdcaa87d9750e6f972461a9ca6aa1d19dec106ee2ab239a173483aeb3071a362ba3342c65e8383db6c33a0c343f10bec4118ceac835f0e39d6bb93b

  • SSDEEP

    1536:mAHyr2Nc8C6ofdo+oCaRgs0f5gE6j100LibNEpr/n+gvlWTRV:mAaBf6gdoyMgs0WVq0Lzpr/K/

  Score

  10^/10

  miraikytonbotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (176322) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1