Extracted

• • Target
    nuclear.x86_64
  • Size 180KB
  • SHA256 95bcc0a2bb0fff25a2770010406cd0964fd4b3033ed8bae181518f7c8b69d324
  • MD5 a35a8bd7ce2c6d772f02332f26381ba4
  • SHA1 29f98e67662a84e2ea122f0ac4782aefe8e3c0ba
  • SHA512 2b64ccbabbcf4cc307ce3d1f16f6d680550f2ab309e8e4a51cdb73134c0ce6df817ef2f2e79018c30e038bf986b090fafb2934e57b28d7bb13d95bc2f6623dff
  • SSDEEP 3072:o6fBJZVVzg58MZbaTkuxoR0+4QohZzS0qMiQgWlDXTfRRHJAgaKmFnWYl56Y:o6JJZVVzg58MZbaTBxoR04oNPpAThBv
  • TLSH
    T1DC043A07B5C184FEC499C07887DFE536D931B85D6238F25B2BC4EF222E19E606A2DE51
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (75783) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1