Extracted

• • Target

    de8be53fe7c4da18bd8247e453cb8da2_JaffaCakes118

  • Size

    29KB

  • MD5

    de8be53fe7c4da18bd8247e453cb8da2

  • SHA1

    6ee44a216f80e00b51c4f5550e0e25dd15fb47f1

  • SHA256

    fb7a0ec84fe4db3ed5d6beacfb7301d3528e73c51eae364a5d4a75534aefe8c9

  • SHA512

    72622ddf6dc80fd9303ef47d4ebacd89473a167cda7826bcf25d0a0e51eca5a9291a2bf707520d889c5599d594fe78495fc86391df88aa18ea1de036e286f7a6

  • SSDEEP

    768:Fq7Tyuvna7xpIjs6Bna/ZzTj/a8NypeCis3Uozs:F+TyOna2wea/Zvz1NyeCfzs

  Score

  10^/10

  miraiunstbotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (20521) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1