Extracted

• • Target
    849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5
  • Size 194KB
  • SHA256 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5
  • MD5 169457a3e60db046e2f67d5b1ecd0693
  • SHA1 0fc1594c8a32aede708f1855c06ee9c9d65b02ab
  • SHA512 7541538e325e250b3647e221de1dd27af74f04de5624b93d17e4b4fd9bb4aaecaa1012a6c97e224ea8c9262935385294006ceee2af457b491cd984411464c538
  • SSDEEP 6144:ZA4V6IO2l5gP3HbHQw4DaAnjKc4VjL2Fin6M/9ZsuBwMWDM:ZFV6I+DQw4DaAnjKc4kgz/7FBwA
  • TLSH
    T126143B46AA408F13C4D6277AFBAF424533339B64D3DB730599286FB43B8679E4E72502
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdefense_evasiondiscovery

  • Contacts a large (57597) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Renames itself

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1