Extracted

• • Target

    ce5bddff414e0cd4ae69c8e124df512bd6133ec394a4720a054f3597f7e3a9f5

  • Size

    124KB

  • MD5

    bfcb7816fe2bd4bdd4992e4798e90e39

  • SHA1

    849d129a02763948042a8c224ad600f0ce46a2e4

  • SHA256

    ce5bddff414e0cd4ae69c8e124df512bd6133ec394a4720a054f3597f7e3a9f5

  • SHA512

    3612ce26f11e1e8f054ae671a780f36cf8de0bcbfdd54511ad195108d233810ee8e513a05306db7df8f26fa9b56474dbf123c93988d4ad27f47dfd1e6f434fc6

  • SSDEEP

    3072:bfnCYVuBg88hxBItWq6RU1lCyHlIKA1kM/9J+nJ:znCYAgTTItWq6RIlSKACM/9J+nJ

  Score

  9^/10

  credential_accessdefense_evasiondiscovery

  • Contacts a large (216348) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1