Extracted

• • Target
    hoho.x86
  • Size 44KB
  • SHA256 34faac1fc6180ffbd8a2b71e15835ecfe0e6e3a842653e3d1496b112158a9907
  • MD5 9f61d2bfa3e837f49aa9422cd1e3e901
  • SHA1 fd115ac9792d817eb9cfb547548c3352a702ede0
  • SHA512 8eb9c5568801ca148e43a00f90b4711ecb96636d4e8194e6be61aa63fa8cad21110e9ba6492ac188c4b0ba75fdf4b6c6540b836d9c17b032b3aeed65a678c26b
  • SSDEEP 768:gjo8WnBsux3TUi32+4qbBYSWLxD9NnbZrYMbJoSlO+Meb4ah:gWBsux3TUiG9qbBYSWV9N1Y8JoSlO+1P
  • TLSH
    T186237CC0A543D9F8EC150AF43173EB329B7AF07A2129EED7D795A432D841702E54729E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (575903) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1