Extracted

• • Target
    jaffacakes118_af641170ffa16c85ab9b8b7029a5cadde2ab570793a63977587e369a9b019519.bin
  • Size 104KB
  • SHA256 af641170ffa16c85ab9b8b7029a5cadde2ab570793a63977587e369a9b019519
  • MD5 bbedd83655fed63ac4bbae0d5c5451d4
  • SHA1 c4ec6ce2e6399d8d1d9f84a4ab4de5623f317b68
  • SHA512 e876563a64f50deeb4af7864da60bd35674c1b0429a37a1b3a4f763354f046f6e4b897fe9bb8274ae8b3d350f9973414e7969642ec895ee431d9d990b7ac8804
  • SSDEEP 1536:3A1KLOJJbMI1yOTxTFAhWWBIMRx0XNBGrudNngO3dVyKtr+6+L+cHdu:3A1JJbX1yOTxO8mIMRx0fdNgO3/yKti
  • TLSH
    T1F6A30BC1F88741F6C90749387097F73FDA32D97A40319AADEF989E36C627A01911629F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (659922) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1