Extracted

• • Target

    fdf46f6f5ab127af6c75c7e9e23467de_JaffaCakes118

  • Size

    38KB

  • MD5

    fdf46f6f5ab127af6c75c7e9e23467de

  • SHA1

    f5adbe1de700df6fc79c1408795ce60bd07785bf

  • SHA256

    59678d1f5301784e37aba61e6774aa15ef3e06495566d1506ca8c8684c81452d

  • SHA512

    49013daafa9513c9a3b8ba7753b6c08c117b842be74d8005a7dd34e3d56b01b4d324a2da9a16bba4966d528be22d9c322b06936ccefb4b5e8e85fa56033472a1

  • SSDEEP

    768:ZkRdVMqfF6yk6e83nlcZXAiKFLZBphBf5+sqy2uaNo8JgGlzDpxYsl:276qfF6oe8OwjLzphBf5+sgPVrYi

  Score

  10^/10

  miraikytonbotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (104127) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Writes file to system bin folder

  behavioral1