Extracted

• • Target
    d7f221c0fe45b1e2da7bc04540d4074d4371d5ce24b2e1bd831752679eab975c.bin
  • Size 21KB
  • SHA256 3f87677baaaa7b07962390f472753f8db457c8118e40ff849b90d20582f9ef4e
  • MD5 55afb4be3bc0ead783b5d40606804b38
  • SHA1 ee8255e05e52062e0b404cd33e769d3414a42bf7
  • SHA512 0bed674b9c2237596259e00c2acb540f4fe28604eb0a3383d1f9082994c58073426440a4b09ba4495202b2621aca492e3be502416e001c02789846ba92c8bc7d
  • SSDEEP 384:M15Kn2cNV2Jq5AeA2vH7dJg7XmTYc1xAG1vUEb3ONfU8cTkXSEKSudVG3Nyq:w+fVB+eA2vbs7XHyVhdYfU8PSE6Vlq
  • TLSH
    T13CA2E13205391F5FC6F4F232969ED916F1416CAA87B1131B55E8900F327F22D70B59E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetunstdefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (69926) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1