Extracted

• • Target

    e01c10e50957583620595a8d5911e5d7_JaffaCakes118

  • Size

    31KB

  • MD5

    e01c10e50957583620595a8d5911e5d7

  • SHA1

    4ec47e080b1fe235733a1a3ef798c6d85da1bb3f

  • SHA256

    138a0d5be852eaf2b265ef1ebb6e96a4e79e7c38441fb8aacd513b6a95c72497

  • SHA512

    8787b95800f8c8bf0d7fe0a3cb835bb70108115222bc9423ca1e5f362cc6b5d7f589ee1f129649d23eeab1920d2827d6c48a7fc76b1a10f887d4951b2d2c3bea

  • SSDEEP

    768:JbkNqg5VYGgxpepHRVT/2ENsKZM6SC6pQuh1iD3Sa6pMWH:JbkwSgxpeRv/LNvDSC6pzTiua6z

  Score

  10^/10

  miraiunstbotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (20144) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1