Extracted

• • Target
    a258d5993fcfc465d13eabcd3ffcb0817d47460015b85464124afcc593decb44.bin
  • Size 91KB
  • SHA256 a258d5993fcfc465d13eabcd3ffcb0817d47460015b85464124afcc593decb44
  • MD5 c5d231fb397038c95330937ed0b1c760
  • SHA1 2ffd15ffba16a87765e41208565832e198e4880e
  • SHA512 bb6f0a0be6571d97f859da2f1428918f1204f04c42970440d5ed99159f46ea056622f86fc1028bd3c824d2c4abb8a7148a9119f05f22417a33e11886dbfabf61
  • SSDEEP 1536:uLoYtmR0d4zwr/OAoJF+8JwlAUWJEn3ZZB/v7vROlUwbZn7W:uLoYtmRU4BAHnWJq3N0KwbZn7W
  • TLSH
    T13C93D619BB510EF7D89FCD374AAC1B06388C958622A47BB57670D828F64B14F49E3CB4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdefense_evasiondiscovery

  • Contacts a large (23521) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1