Extracted

• • Target
    f804610bd533b078ceb5de305a23e4e4bb3cee9a9b77ad4955f30773c47cbbf2.bin
  • Size 74KB
  • SHA256 f804610bd533b078ceb5de305a23e4e4bb3cee9a9b77ad4955f30773c47cbbf2
  • MD5 a4099065002a472730b2ef48cc3735cd
  • SHA1 d0c38f0e03920d27838c193b6a6dd8958fb1e1e0
  • SHA512 8bc7b3098de94c2ad1c60ef6eb4f6b4d51861bea8d4ef0b0a2d3173336564ec7e840b3c7f6538325184f30d132fa5bb9135fa46ee98b7bafb57d7729febfa533
  • SSDEEP 1536:xbnlT+5CnCesXk+2zuTQLW8pm9K6Z+jnKELHOlkG:xblawnCes8cQLpsK6Z+TnLul
  • TLSH
    T1CA73424E2E319F7CFBAC463897B78E215645339636E1C684D1ACEA011E7434E341FBA9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (48319) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1