Extracted

• • Target
    jaffacakes118_f2a118749d936dcda65300ad2c9e3156bff51784312469ebdc889d1a7566e148.bin
  • Size 128KB
  • SHA256 f2a118749d936dcda65300ad2c9e3156bff51784312469ebdc889d1a7566e148
  • MD5 4e9cf8abff11cee891594dc8622e0cf7
  • SHA1 fef663db075e5f612f14468c79c9d71c607ac860
  • SHA512 2dfc4767dfff3e9b3fa40d27f6df16443b85f6debe750b450bb55f6a7873a3db837a2e419d07837bdc17fe82906307d59c1a3070a4720952adbddc9a2ea41960
  • SSDEEP 3072:I/fAuH/zlbmuq1pMzJxSbkns2RcAnJzTIDKTuM/9XD:YfAE7lb6Kx6kns2Rc+JgDKqM/9XD
  • TLSH
    T1ACD34B06FA818B13C4D517B6BADF41453323AB64E3DB730689185FB43F86A9F4E63906
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (216030) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1