Extracted

• • Target
    c57b4775455e007a1a2519d0954a87ed09d6ad055fced0ffb27ffb09293bee67.bin
  • Size 86KB
  • SHA256 c57b4775455e007a1a2519d0954a87ed09d6ad055fced0ffb27ffb09293bee67
  • MD5 79131a238bc710e00d270c06b8e0d89d
  • SHA1 7763d494ce208017a77bde434ea50f0e5a254656
  • SHA512 4c33546b7d37d6ade8833fb7ca89cd583cca5b8feee00c8b4b8ef5ca7382b7edcf101e4e92c5ab77d45e5dd1a227322a108761c2152c50607fce9e01b091a19b
  • SSDEEP 1536:590i8LAOoNq/E+zq8EwPU1JP/grfor3HfHXscN1r2C:5GZAgzquoxHXa
  • TLSH
    T15983944A6F615FF7E89FEC3705E92B0524CD561A24A93F79B930D818F24A14F19E38B0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (15725) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1