Extracted

• • Target
    6d4117f233fedfca80773d8f64688001e7205fccaf105b3a52c773b47720d985.bin
  • Size 99KB
  • SHA256 6d4117f233fedfca80773d8f64688001e7205fccaf105b3a52c773b47720d985
  • MD5 7f3e2ed780b3baaad2c16de17d5c4f06
  • SHA1 79bfe81e05d73b188104916fb84d2d2dcbdb6490
  • SHA512 9e7af2412627feaf8dce1958342fe47b5d447ecaa3d2be97a50ee5704a877b33116d7888262e8ee337016cd878a7e4a0bf5e63f04d70af953511f3207bcfcbfd
  • SSDEEP 1536:a2fsCDpMtQagM6PkH406j5Tb06wnDQhPqf/Jc+n7bdEgvchrp/:a2UCDpMtQagM6PHj5P0tfJE5
  • TLSH
    T1ADA3944ABF215FB7E89FEC3745E92706288D611720A93B79B934D904F21B31F19E7860
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20093) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1