Extracted

• • Target

    f9fa1ccfe46315e5e42248c452e2d633_JaffaCakes118

  • Size

    102KB

  • MD5

    f9fa1ccfe46315e5e42248c452e2d633

  • SHA1

    6843b3380328dba9d024c4d67a60a9e390949b34

  • SHA256

    9b310f8cc36a5c713cf5940dd0eec221c04daf9fb528fd45e2f8e81529063acd

  • SHA512

    8b9b32f3a3c2f073bc6578426aa1de35c9ef90871a01dcbd24bef6d2087be3d12f6ca70953f0e27c3d0a7506febe5c0b5560289b7c387e45391c6c18b6460456

  • SSDEEP

    1536:AqHItAXLaFy95bw1kZJc4HZU25dVeB4yOGNH5hWzFL:7L7dJc4HIEGV5hWzFL

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (88498) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Writes file to system bin folder

  behavioral1