Extracted

• • Target

    f25a46510fd8801fdd40ec256fe92edd_JaffaCakes118

  • Size

    46KB

  • MD5

    f25a46510fd8801fdd40ec256fe92edd

  • SHA1

    57324000eff82a018f80e56b266d2ea9d91cf000

  • SHA256

    1b3a12718d5749bc3558941619da426e0038047040e3844b0979ac6f2a6de7a1

  • SHA512

    e7590cb6b6996eb86f1b61089ee0c124f29d9778e657fc79fe8383caea4fdfdcb0c75c9387c1f7ffeff2cd1755742c9f8cc3abbca9bb113bb499c2e579d7f972

  • SSDEEP

    768:mVp4sLQagzfMeOIUlGH3th+gu10mFMI5qkBcNFx0OgAJgFJgGlzDpbuR1JK:24sAzfMTI4GH3iRtMI5paFx0Ox+VJu0

  Score

  10^/10

  miraikytonbotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (167858) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1