Extracted

• • Target
    jaffacakes118_76089aef7a356ab71f1432c5cd1563f22d7397aa40cd8ce5d92e2fd41b65e956.bin
  • Size 129KB
  • SHA256 76089aef7a356ab71f1432c5cd1563f22d7397aa40cd8ce5d92e2fd41b65e956
  • MD5 f91f2ac7db135d23f0773aa1a4d2d8bb
  • SHA1 32c2ceeae2c750d9fbedac82954358f0c758c2b3
  • SHA512 3a4743dd3bf8a66ff1cda94b4d85f443b2b165a36789b16b49b0b3411f05cb52fb829875d6818524c06070e3d7f9425c5ccbb2149ab5accc3a250b573fe5e57e
  • SSDEEP 1536:cGCAYsqUa2HbGCvQG4yTv716s7Itxxb8rJY4wrWh5onJ4inERRvz0MbgF6n:5CALn7fvQG4Yv7svxYrJNwrtJ4yER9R
  • TLSH
    T15ED3F942F8C745F6CC074938B097F73FCA72D9BA41318AA9EF945E35D677A00821729A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdefense_evasiondiscovery

  • Contacts a large (609348) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1