Extracted

• • Target
    jaffacakes118_0f598e0db173d30fb0f804d4ec176a6a21b2e9ae1ee8feb4e860982d82353b33
  • Size 37KB
  • SHA256 0f598e0db173d30fb0f804d4ec176a6a21b2e9ae1ee8feb4e860982d82353b33
  • MD5 8c409b3a085f776dc344117a76ee766d
  • SHA1 16af958efead332c3a55680bdcabe406849e4969
  • SHA512 0aa0401bfafc0238c34ad6c6bccb065a7de54bf1606fd639446ae67aed924a09ac321d3c9bcf42d6faf8446d9817bea5baf99ccddd83a0e5d667fba467adaf91
  • SSDEEP 768:R4NCYBS7lR3bMA9kA48VSstLW5cX33VAMdHCvJTANNbB1/CzUhpnbcuyD7UHQRjM:RN7lR3bX9kA4qtL6oWFJcNBXhpnouy8P
  • TLSH
    T13903F1C7E6F58214D09E9637AD1FB7A703C0C80985B9B7B17BE5E43A1812F799D00B86
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetriftcredential_accessdefense_evasiondiscoverymirai

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai

  • Contacts a large (107317) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1