Extracted

• • Target
    051c3fc0d94d68f4d5efaff28aacc4b8cf916dce30601e8bb358c0681b4b1a20.bin
  • Size 52KB
  • SHA256 051c3fc0d94d68f4d5efaff28aacc4b8cf916dce30601e8bb358c0681b4b1a20
  • MD5 afc4c14d0b5bb4231187e8e8e0b77a2d
  • SHA1 a0952b5ba8c3ceb1328d4a8937877779f491357c
  • SHA512 8ee4477528f17001170cdc9090726ef22fb04009ef86e30d1ac269901e91e683a62f773faa2d094dd7e2264970abae66ec51b915f587f568ff9ff3f10a72cadd
  • SSDEEP 768:9Mte5B4PACtw/YcmRIe18D9q63TxZQbSORe7Su2QJnKE79TLrX+Yaq3UirYOs8qz:9M84ISRX63dZQbS5rzZuYxVmWjG
  • TLSH
    T15833F15560047162C7B03633F82B1093FF4A17FAD6D23437192943A4F8E95A37AFACA6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetlzrddefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (20134) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1