Extracted

• • Target

    87950807af7be801d3097e7e53fc79c5_JaffaCakes118

  • Size

    77KB

  • MD5

    87950807af7be801d3097e7e53fc79c5

  • SHA1

    bc703ad9ed3ce5e38654faaffad757365a3f416a

  • SHA256

    07f8ed86e1bdcd424e394124d2484628b2501bcc655c252b6886f606468a4252

  • SHA512

    8b36a391ce8f2c33b0ac9a6ac45626a8f6d39e0bff9b4fd72ddf6934887363531dba42d325036a3bba413919bffbbc672a5c4b7ab0fe2642229d489fb10f29b2

  • SSDEEP

    1536:w4CHLUay6+vl/y17wTxSRgMnhsmVBdBhIMSXtLjpsme+Z:36ry6+vdqwdSRgMTThIMwt3psH+Z

  Score

  9^/10

  discovery

  • Contacts a large (20598) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  behavioral1