Extracted

• • Target
    jaffacakes118_ad1968a94139602e2fcb56ec6a8556d5fa35fad4ef33f018ee77f2130326d45f.bin
  • Size 125KB
  • SHA256 ad1968a94139602e2fcb56ec6a8556d5fa35fad4ef33f018ee77f2130326d45f
  • MD5 35fcd5962524989d170b27f196a45928
  • SHA1 2db4f2593b2a0788cd6a427dda70720296617359
  • SHA512 e132222439b1d983d3971507f79b32d2d3fe27128413a88d71d03eb5bdd5912a4735d35d682674a8e03510f46b1f48fbbf594a2ca946a2b266d5b3fa5aac997f
  • SSDEEP 3072:+HcNQL9WkpPbV3UB1LLaQd4NQCdKIizQGfNZ2K:KRZWklbV3UtLaQd4NQCdJafNZ2K
  • TLSH
    T1A8C3E745AD429F11D5DB32FAFA9F018933536BA8D3FA7101DD205F6023CAA9B0F76612
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  command_and_controldefense_evasiondiscovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control

  • Writes file to system bin folder

  behavioral1