Extracted

• • Target
    bda32c2cda05f7ff4aa6e72a41a6a335a8840bf5c089c3d3672bf5332093e3d6.bin
  • Size 66KB
  • SHA256 bda32c2cda05f7ff4aa6e72a41a6a335a8840bf5c089c3d3672bf5332093e3d6
  • MD5 3699c1db321a2be2a41fc97c406726dc
  • SHA1 2c3e52f597218be93462f30d9ac0eba8b42e2c71
  • SHA512 61132098a8362304bb2e50cc28a14a61e80bfe515f10b82df186328f6ba97f62bab708636c3be858e00c4aa835e964615c214c37b19d3c85b41c1f2c38b8d4bf
  • SSDEEP 1536:I4ogwLPZVVgnKrFornKBhl614Z5Ha8og:I4ogwDZPhw14
  • TLSH
    T14C63500ABF611FB7E8AFDC3709AA1741248D550B21A83B69B574D818F35A24F16E3CB4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (65598) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1