Extracted

• • Target
    JaffaCakes118_372f1da501b29cfc853f093936e4f28f
  • Size 69KB
  • SHA256 819675ec3e493894588d21d04b3ca2ee080392a50c772746a92f583aac264576
  • MD5 372f1da501b29cfc853f093936e4f28f
  • SHA1 6c8d6c70326a6c0d210ed4bfff2424c2d4794b4e
  • SHA512 5eabbe0dc4acb832d9e66b6150085e946f6ac30692c37b3a4d10a635a5668304a577aec2ddb9634d36eba764e798e5f7f8e6ee4e038b39afbd78d00de1ef6d99
  • SSDEEP 1536:5OFwK53EkRjAp3O76ipfEWzNVqw72XhRg1RfkLGsCEhi0cCPzJf:5OFwpWAp3Qh1EWzgXhRg0LVCDnCPtf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  botnetkytondefense_evasiondiscoverymirai

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Mirai family

    mirai

  • Contacts a large (199589) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1