Extracted

• • Target
    1dccd88d437c338b3dd1049e75f1219ab2c683ba6522dec6f9d3fc9366993968.bin
  • Size 74KB
  • SHA256 1dccd88d437c338b3dd1049e75f1219ab2c683ba6522dec6f9d3fc9366993968
  • MD5 9a2e929fcc1ed2b8ad774b77ca7093a1
  • SHA1 88aa27427da64dfb4a55f542b4eb0587d249ecfe
  • SHA512 37028644160c76574c758c9884b2aa2a1759918226626da29f6fc55b84e79eeefb1fb284686f78176b58edf6d9ea830a5fb9898f5a0cf0b2c75262225403ac54
  • SSDEEP 1536:CN5F+sNzL0HpLQwgaOpyeUtdkA0P9ZYV6Fn9+:a5F+OMpUjpLP9
  • TLSH
    T1FF734F096F611FF7E8AFDC3709DA174524CE651A21A83B79B934E818F21B24F15E38B4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (68958) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1