Extracted

• • Target

    ce0fa512185b23a32b2062236a2eeba4_JaffaCakes118

  • Size

    54KB

  • MD5

    ce0fa512185b23a32b2062236a2eeba4

  • SHA1

    22c39ef0e3a3392f3c827eac93db120dc3f07a39

  • SHA256

    bed650466d8b5d1facfea21f046654b067d39529c6ed252fb07332250cfc98e7

  • SHA512

    3adaf7954da0c3ba95b8e88327fa4053765f42a2af4a31dca445a03ac379309ce93c58bb2c45cc87f881149d6e3f1627a4b76f7eda2cc416a9e4234589c9946b

  • SSDEEP

    1536:d6EwVWibZ6uzpNrmvFtWbFhWWCTZ7t+xc:QVWYZ6uzv4FKFhWWoZ7Qq

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (24035) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1