Extracted

• • Target
    5ad37c8ab411d045603fd2f09a6761817e6f16b936ff00e1584e0a1968ec3314.bin
  • Size 89KB
  • SHA256 5ad37c8ab411d045603fd2f09a6761817e6f16b936ff00e1584e0a1968ec3314
  • MD5 95ac78dcce7e79abb6adde360954abb0
  • SHA1 107dbc7e430039a1937d85aeb68f56c898878ff0
  • SHA512 9f2beaf66f369c173dde06fb6789affa084180d1df2f4dd430452e8523a8ee8275964fd7645caaeb271db19f52fbc8c3aa2e4e7e48557601eda208b0b3883e81
  • SSDEEP 1536:4YRS2cWY6f6utWSVSDYFMMwqZ9adsR0vf7y9vnk5zlf/A4mqvrrb97K2M:1I2cWRyutWCSDU9aE0Hm9Azlf/A4mOr+
  • TLSH
    T11D93744D3E219F7DFFAC823887B75A21964823DA66E1C585D05CFA021E7034E741FBA6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20490) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1