Extracted

• • Target
    c4d9c7e644806fad3a83a083e3c8d487bd2788a996f0b7aa01712ff68f6dd3d9
  • Size 176KB
  • SHA256 c4d9c7e644806fad3a83a083e3c8d487bd2788a996f0b7aa01712ff68f6dd3d9
  • MD5 ce47b8deb932398ef97e6112bc7de633
  • SHA1 70e31bd115480ec88ad4629e3d4cae54ebb0f41e
  • SHA512 16e31412ce87c912c9f208cb6f20bcf4de5641f59bca2b5385184fadafc8f2cabd5ac0bb9c0c77341552b3fb4693b1649044f2b00aedc940cd2f85461ab370b4
  • SSDEEP 3072:lRu97jI4rqE9SsRTM6/JaOf0aHd3NYjZX2juOVQrmvN7BM/9+OomIjDA:Pu93I4rbSsRTMkhsaHd3NYjh26mvNdMj
  • TLSH
    T159044B46EA408B13C4D32775BBAF42453323AB64D3DB73059928AFB43F8679E4D67602
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdefense_evasiondiscovery

  • Contacts a large (56802) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Renames itself

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1