Extracted

• • Target

    7042a854582a0c4896844a1138e0be06_JaffaCakes118

  • Size

    72KB

  • MD5

    7042a854582a0c4896844a1138e0be06

  • SHA1

    46540fbfcbe76366332e4600a2665ec4adbe84be

  • SHA256

    13d8122f534891514063f585c20d214823451588856bfc3b1a5d435fa89c9f61

  • SHA512

    d2db56d174f99ea4df1958a95e94e588a3d28e7deddaaf73942d9076710a6f2aa0e075e2cdebde05804c88d26c6cdf4b77c87d70943c2b6d76b1a4dee8cce3ec

  • SSDEEP

    1536:jwOgQ8JS4OZm3/W97kJ2f4ol+QLk+l3LugvSWy/ReAwJt8A73el8:s39HJ2f4ol+QLk+l3LugvSWy/oAm8iui

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20527) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1