Extracted

• • Target
    jaffacakes118_0a5b558d4bd5bcb627a9bb2dbb51f4e633272442938fb2fc9100b4c84d107219.bin
  • Size 192KB
  • SHA256 0a5b558d4bd5bcb627a9bb2dbb51f4e633272442938fb2fc9100b4c84d107219
  • MD5 15cae11eb4aa23016f2e4a547f85c372
  • SHA1 76e9777077be636f98f79df667890f8948e07c58
  • SHA512 aa94175b16fd51e1461acb40c945b45372265ad02ca1e74d9568be586ffa702da3b2a5f0387d6deb50b92519f5041236cfcefb47a1b1b598f75fcc589193586b
  • SSDEEP 6144:WjzjTKTbNMKzaF05Y0vHHimn6WiPM/R0Ev:WjPT6MKzaF05Y0vRli0/OK
  • TLSH
    T147142945EA404F13C4D727BAFA9F42453333A7A493E773069928ABB43F8679A4E13605
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (57232) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1