Extracted

• • Target

    30c934df961394d6fc706e30fe7cec49_JaffaCakes118

  • Size

    72KB

  • MD5

    30c934df961394d6fc706e30fe7cec49

  • SHA1

    417d3f7e252bd098c564708207011ffb9e8ab831

  • SHA256

    5e7b89f7dee827d08917189f8dff6ae2011ae41400734fd743ca1ba6564acd03

  • SHA512

    79171ff4258920a3a7195185aa73d63bb5165c1771379e0c19302d869248f948555b3e718a606b540a7b0e234a70f3c8a00be4347f8d3c2b3e1a9bd7b47239f6

  • SSDEEP

    1536:sEtOX3Px857M8VVqXo8lGKloNwm87Ze100rsSWg/M3AviAOR6BeY4wnv:xtOnPx857M8VVqXospV04SWg/xviv68q

  Score

  9^/10

  discovery

  • Contacts a large (20666) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1