Extracted

• • Target

    ff5a3c3c0ae48940230e9f63cbb8a881_JaffaCakes118

  • Size

    30KB

  • MD5

    ff5a3c3c0ae48940230e9f63cbb8a881

  • SHA1

    93caee4a6a461482213b283d76f2e4ab5e6765d8

  • SHA256

    d4e4b7ca41b6d0e756e9ea414024e876f4982b9c2d33b50006f1969b53736449

  • SHA512

    e99d74e9708609f121aeba294ff10f9715d97ea4dad858995b2de70d3f4c659a466c701109834c2f42a7789b13df897360c88979be09401a0a24ff156781a426

  • SSDEEP

    768:1/M2ZczvACRtOJFwt5skyZ+gHkm1PyO31+WHJgGlzDpbuR1Jg:10QczYCRtOMWEm1PJrFVJuW

  Score

  10^/10

  mirailzrdbotnetdefense_evasiondiscovery

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (20443) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1