Extracted

• • Target
    7f0bfdf3262f48535aa4c74835453717413d247ec37dafb3ac895bcfa2cd5011.bin
  • Size 89KB
  • SHA256 7f0bfdf3262f48535aa4c74835453717413d247ec37dafb3ac895bcfa2cd5011
  • MD5 6c84f47bfe24d794ce2a2bf0874f517e
  • SHA1 2628aa0d9ed63b8b96b25772722fd1400c8d7ee9
  • SHA512 a81afbefee8a641522e27b9ae7708cbd1c983d736fb5c4d4e6feb17d591c4e6b137ee916fb0a828b41beb0d8a5d2139c980d5ba102aa40e493d98d8c69a26f0b
  • SSDEEP 1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZqYi:qCYxrKDy46Nd
  • TLSH
    T1DE93800AAF611FF7E89EDC374AD92B0524DD511A20AD7B39B930D818F25B30F19E3865
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20308) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1