Extracted

• • Target
    f66ce08d7fc79340e4c8acb554caacde8321232612a871d7e1dda0616930a5ef
  • Size 176KB
  • SHA256 f66ce08d7fc79340e4c8acb554caacde8321232612a871d7e1dda0616930a5ef
  • MD5 7ea0f0edb229c18cfbf01a51293b60bf
  • SHA1 9a07067cbcb5150d7c0baa4c3a9e82fedba0c762
  • SHA512 8a0d282261e4a7085c139fe5515740d6fbe2033eedf1d69afde89f4c71bedbf4f71f1054ed239e1ee52ca7cc71e47d7269742b820d8c818c0e2b767cf3e554e9
  • SSDEEP 3072:yizljtAaqYBlsa+vTHEF9mrsplDKZUxQBKXAVantbX+F8Jyvae8dqCqayxJLb3Y+:yixjtAaqYBlsa+vTHW9mrsplDKZUxQBt
  • TLSH
    T113044B46DA818A03C0D6177AB6EF424933329764E3DB73069D18AFB43FC669E4E73605
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (23921) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1