Extracted

• • Target

    e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118

  • Size

    150KB

  • MD5

    e8a797f0c211f49f06e39eaf4fd61c11

  • SHA1

    68c5fc8ab1d172e35cd916f216962d65ad94147c

  • SHA256

    f9fd50c34fb5a95cb6ed85a60a2935e2f6b18cdb6872da91f73c810abdf48cae

  • SHA512

    1b5e7665eca7f9124de3ba08e7e169a9b3990b83921f3187b14780c2363120246841768e3e2295ce647e7dbe5e50305cebb028a88e40f73a00545d3d438c15e8

  • SSDEEP

    3072:YfA8x4tQotpnpW4l5BLAgQkexp+5gRJUpjOhmN0sVhpzDkp0rN:OA7Ps4lDAgJI7It+mN0sVhpzDkp0rN

  Score

  7^/10

  credential_accessdefense_evasiondiscovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1