Extracted

• • Target

    1587-1-0x0000000008048000-0x0000000008053ac0-memory.dmp

  • Size

    44KB

  • MD5

    96430e8572719a4c67f4ccca4e7d1ed4

  • SHA1

    d7b5f4157ee0e813d5e05cea849807970cc30f23

  • SHA256

    28347513c9f0ed167ed25a5a4489474d700abb649153f75a76145c1c9f02e0d0

  • SHA512

    1ce409a42ea9b299a31b768b66bcb77f5c8d31f47bb0b2a9ea228aead4993bda7e33b1d913d86f3f1ab7a475b16019a7338ece15ac2d859099c0f7857fbd7bd4

  • SSDEEP

    768:YxYMnWMWM9b7xIxkXZLcD0FYCgT5ar0k7xM2waZqjH67YnnxJ5zPJau/5:YqMnWxM9HxIYLcsyVar0k7xMqlYnnxz/

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (70067) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1