Extracted

• • Target
    jaffacakes118_c6e04ddccfe5b6826ea7a1ede61e46a7b8f806dee023a05b790fd876fbe370cd.bin
  • Size 36KB
  • SHA256 c6e04ddccfe5b6826ea7a1ede61e46a7b8f806dee023a05b790fd876fbe370cd
  • MD5 31ac53170c768f2f26b355765dded1f1
  • SHA1 3173f9ccd1c4ad5ffc8a5e08e1536121bdf6a147
  • SHA512 55d8d7fcfc0a0da3f83071f57b4c9d4d2f675a05cb685b8a75aa6d2492ab210e90111be85729f1bb0aa5f72d7d3f1a3fc0326196c5eb5201da19fc591c57f7ea
  • SSDEEP 768:dicM+4m6tF6LmxtSiQxi036WYR8OwKsbg9vvHnsdFyTnbcuyD7UiyqZ:dicM+LA6LmxtSpshWO8D43wATnouy8Zy
  • TLSH
    T15003D0C2621CDB88D12990310DBAB14E5E50630DD58346B3B7B8646FD8A1B7E3D1C3A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetunstabledefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (510463) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1