Extracted

• • Target
    8516406ae0b2758672e1b2f76d673d89928bea7eaa1b6259b59c863d9c2524e8.bin
  • Size 77KB
  • SHA256 8516406ae0b2758672e1b2f76d673d89928bea7eaa1b6259b59c863d9c2524e8
  • MD5 0ee6c53736170b295c7da4f0f0c639ea
  • SHA1 1161ca4244d21e3a6ea2bcf9fe7ba6c4c4ebdce6
  • SHA512 c72a994f00730039fad25c7f554a3d93988eb00d6dd6cfa69f3602e9a7c12380faaad3ba42f1c08213fc3544ba61c8a23228db9f6c2c19bd917bba82050ba6e8
  • SSDEEP 1536:G4Z8LUay6+vl/R1KIdysUmR9EiYHXwKdjVJhaM75jjETo:B6ry6+vdGIdysUKqBJh77xjIo
  • TLSH
    T10773840E2E619FBCFBAD863587B34F209248339626E1D545D19CFA011E7034E746FBA9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (21120) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1