Extracted

• • Target

    2d3144883fd8d46e3b8767dbbdccf001_JaffaCakes118

  • Size

    130KB

  • MD5

    2d3144883fd8d46e3b8767dbbdccf001

  • SHA1

    d81d91e64cd02c40a8f6505a37f10432933c7084

  • SHA256

    ca7799ab2f4afb0c08ef11a9ff7e8a88f71e74798aaf31c5aac7f0fce6abf678

  • SHA512

    c459312b30680e43808f04fc3878ac75e0d06e270493e799f1df7d131b83051b3075764bcf4a4cfef1b0f6469a8caa57219c920d600557eaf03bcf1e94a1c275

  • SSDEEP

    3072:Mb3c3l+KQnWUXwbEA35HTdnU+ZBley/Z4XfIermq0ichYyeaK0FU:Mbs33OYRJzmq7/Z4XAermq0ichYyeaKD

  Score

  9^/10

  discovery

  • Contacts a large (10341) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

  behavioral1