Extracted

• • Target

    e7d48ea70638000b07b3beff71475597_JaffaCakes118

  • Size

    56KB

  • MD5

    e7d48ea70638000b07b3beff71475597

  • SHA1

    a19693194c9257c77d0f31a61ea00f28f54b27ed

  • SHA256

    8aa5ca55e2c2f398830238648fa055a012ee8b581e1603ce35b94531acc91a99

  • SHA512

    0d1222a8d872d13d6cc32e0e1dac332249b059b690f1ca7658cd734f4f9a5554fcf30c824084eb4032b27fafe799291c12b8acfb43f2e8dc0326edc9361f0c9b

  • SSDEEP

    1536:Rjx5Vw6sWbr+XEYzv2kRZF2XMCULYpZZ20Irj9Nm:RF5C61mdOMCULuZZ20I/u

  Score

  10^/10

  miraiunstbotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (212913) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1