Extracted

• • Target

    e8aa348d51bd6f996ed95e5e612cdc8e_JaffaCakes118

  • Size

    21KB

  • MD5

    e8aa348d51bd6f996ed95e5e612cdc8e

  • SHA1

    cf44cfe5b41f593fae214c0a0171f7a7841f8133

  • SHA256

    6a66c61db58dfba87f49c1e4e1c24bf1d33ad4134e23d28753da9d2550056784

  • SHA512

    a422053877013ab436fd065aeed9cda142eec0f6beb83248f211d85c998edb2b1058292b57a290974fd22de5008c430cdda1989264c9e5125b0214838108be37

  • SSDEEP

    384:3D+rmepgK6/4C930yQjc4iNorn/aaYbPwCvZ+Yy6ghtDHBnbhymdGUop5hY:3DApgp4C930yton/a/bPHv8KghtRs3UR

  Score

  10^/10

  miraiunstbotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (69903) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1