Extracted

• • Target

    fa1e32cbe0584607d7ea9ecbbba007f0_JaffaCakes118

  • Size

    58KB

  • MD5

    fa1e32cbe0584607d7ea9ecbbba007f0

  • SHA1

    2f293364fbac2e6bf9991405c731dc397fff3b72

  • SHA256

    e4f564bfa67ec5c03a377d68059c384772583bb1b8ad9df985417c08dc74dfe1

  • SHA512

    1e3d4e6737dc96f78b6885da4509b0267c6dc3fac6ef5771ed780312f09321e7fd81b784ad3587dbf5b19a960b44af43538a6bd8a0319664f30b513e43f8ebba

  • SSDEEP

    1536:/pT+/t4SHZDS8Ln73MWX+3ZcWbZpl5t5W8xw1o:/pT+/HZDS8mSUZv5bW8xio

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (8155) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1