Extracted

• • Target
    790788c47dd14f4f25ab7befca04cdccf78b3071ac706f9ec3333e2faaebeeef
  • Size 83KB
  • SHA256 790788c47dd14f4f25ab7befca04cdccf78b3071ac706f9ec3333e2faaebeeef
  • MD5 6497824583422cf1d6f524d614e918cd
  • SHA1 f02d6c5c070e58766ca19ffba4858b25a543be40
  • SHA512 d1918bb3ad0fe4cb33466ed8e756e1854e72f7e64f6891de17d178d061031783a756fb58a804c33c2aa4675878b7aa7afffaa1e1d91da62acd21b048bdf63c04
  • SSDEEP 1536:ATNuOfMLWePYeNnVTbBub63gbyLa47Yj0ZOYhMsQEDdiqYRKROEMMgU:cHBePDNnlNub63gbyL/Y2hMs5DdiqdRq
  • TLSH
    T177832A02B9C085ECC189E138077F763AC425F1BD627AB2D73BD5BF1A2C19E501B1EA59
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdefense_evasiondiscovery

  • Contacts a large (61222) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1