Extracted

• • Target
    dbc3fa2058fa414d466bb6d476f2bc526b610c9b13945166f060df67b9980a1a.bin
  • Size 89KB
  • SHA256 dbc3fa2058fa414d466bb6d476f2bc526b610c9b13945166f060df67b9980a1a
  • MD5 19cc7ba1e7fbee85599dc850907294b6
  • SHA1 fcdc50032b4c0c1deb4d282fced2b50582f862b7
  • SHA512 eac1d6bf99bd5ad69f64f92c28ead0c9e3fafe340e919ecea9a8d846adfa218d9ca9560f946eef4feff1a83509320bfc5d88158505e8c2a964d11fbea8a17bb9
  • SSDEEP 1536:4YRS2cWY6f6utWSVSDYFMMwqZ9adsR0vf7y9vnk5zlf/A4mqvrrb9iK2M:1I2cWRyutWCSDU9aE0Hm9Azlf/A4mOrJ
  • TLSH
    T1CE93744D3E219F7DFFAC823887B75A21964823DA66E1C585D05CFA021E7034E741FBA6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20513) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1