Extracted

• • Target
    fa0e5f94022c8f4f4f13a335435a207ad817716711fbb2f067121fa37b39147b.bin
  • Size 122KB
  • SHA256 fa0e5f94022c8f4f4f13a335435a207ad817716711fbb2f067121fa37b39147b
  • MD5 9109b93bc43d0f4df29a35c257155d24
  • SHA1 3353c65bb585254d5f5fde5a7a60e99b502aa399
  • SHA512 ad04abfdb20967aac4d229efe8c073a36574c07df7ae1cfc3e2f31ce818d45c3bba06cbdce72e29ee43c7f310479a3b8fab3cc6bbff0c5c184d72d855a385ac7
  • SSDEEP 3072:koB/8lXeMpCP4dujryRgHGNkDa50TKJov+uov1pY8SyXoRtcuf71kM/9Yxx:koB/aeMpCP4dujryRgHGNkDa50TKJovs
  • TLSH
    T152C33B46EB808F03C4D51775BAEF424533239755E7DB73068A18AFB83F867AA4E23506
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (67373) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1