Extracted

• • Target
    jaffacakes118_e9a9622c6d8b738d38bfa94580ca35f5d91c435c05f0708bf9ef283f1405f2a8.bin
  • Size 74KB
  • SHA256 e9a9622c6d8b738d38bfa94580ca35f5d91c435c05f0708bf9ef283f1405f2a8
  • MD5 f4d66a88feb5e116b9ce5267eecf21c0
  • SHA1 f10db52ffacd59f6df1e8324ab548c4520f6c2be
  • SHA512 38dfc0991f084fb8ed81a6459a684863078609f548033782eb954faae69df5a45534b3b34287edda53eae01cfe36473282154c654f60e932e7c5514e8bce2859
  • SSDEEP 1536:vnTlO2ULJfwnzgRzLoxtVr9j9EybWrNnAeX9:vTE2ULJfwGEcN
  • TLSH
    T1E373C619BF610FB7ECAFCC3749A91B0529CCA51B21A83B757934D818F24B64F19E3864
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  credential_accessdefense_evasiondiscovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1