Extracted

• • Target
    jaffacakes118_9b520d16f6ca6ef234eab75ec31e9ff8ac8892001941c0cffbb7f18ae4f7eeb3.bin
  • Size 74KB
  • SHA256 9b520d16f6ca6ef234eab75ec31e9ff8ac8892001941c0cffbb7f18ae4f7eeb3
  • MD5 69108d16fa9d45855d6eae697a506098
  • SHA1 b8bb5ee6f7c79454f41f6426b1cf704672f9a192
  • SHA512 81078737aea2cf117999cf391fac3d40c3009c4c84f6f821ec12d8b8807aec04b2eaa1c0f0dac0b8f0155cd9d3fa98eaab1f30b27ee6713ea1baa45ef7ef3d71
  • SSDEEP 1536:0f27UhuJ2pq1pD2ofv61cnI+HLOQw6Hj:0e7AuJ2pq1fvJw
  • TLSH
    T1E473C709BF610FB7EC9FCC3749A91B4529CDA50A21A93B75B934C918F25B24F09E3874
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdefense_evasiondiscovery

  • Contacts a large (212992) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1