Extracted

• • Target

    d62cfd3907009f82c45fb994c1c45bc5_JaffaCakes118

  • Size

    64KB

  • MD5

    d62cfd3907009f82c45fb994c1c45bc5

  • SHA1

    3b19c3cfe8af964b41ecb049f067d617973ce064

  • SHA256

    aadd07ede7b53f90d841dee7af847a3f6b29d3da7583186c2fd5bb2c1b88e2b7

  • SHA512

    3928fee2d964e10c5fc316f0c2f0b0942fd05b6396e0337da9cf53a1bd227fb454171efd9f7c36ff6126765ab50aeef3aa1d59e3302a435c6387c9175b837956

  • SSDEEP

    1536:+rl46QWtBrYQPNseLL337hiloH6WSWuX/MMOCs2qg6U4e:G46QWtBrYQPNsef9im/SWs/dOC3qR9e

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20365) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1