Extracted

• • Target

    hoho.x86

  • Size

    49KB

  • MD5

    bf4aa62f73962f5f549d590bb1af23c6

  • SHA1

    1d1d0e042c5d2f1545389c3890f35a809dabca59

  • SHA256

    c2f41ff599406f77d06093c7d23673e5e7bad7ece180e77f2ac9859df9bc8ce3

  • SHA512

    fc47f2cdf90985dedac50888f695760925fd539d29fcc698fb685c5b73cb152e98da12a3df4dda4bfbab2ff415aa486f19a4e928047cf97fa18df75a4f3143c7

  • SSDEEP

    1536:ihLWDE5czODWnT/dZ7DO5FfAuxFIYhcN2R+/ek1Fpw6:ILx5czO6T1Z74Fhh+/eypw6

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (58294) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1