Extracted

• • Target
    jaffacakes118_534865faf1b61c3e898618b597cd8cee9e4ed08325f25a9d69d0006f50cfc88c.bin
  • Size 74KB
  • SHA256 534865faf1b61c3e898618b597cd8cee9e4ed08325f25a9d69d0006f50cfc88c
  • MD5 69853e8e12c172cdc277c1a21cfc795b
  • SHA1 bf0c4a856156d6715695c183c7362fb3d7b7dd2c
  • SHA512 d79603e5832243d245ceecdf23031bc59de1925d052be9e2067b7b1b272c4669c7a1a1c16587da215dbd67489c19f14aac55815bd740eb91ba562ac70cc8763d
  • SSDEEP 1536:QnT9O2ULJhwnDuRqWjKfkGnVsSL2gtXcFA53:QTs2ULJhwQv0X
  • TLSH
    T1DF73C619BF610FBBDCAFCC3749A91B0529CCA51B21A83B757934D818F24B64F19E3864
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdefense_evasiondiscovery

  • Contacts a large (208744) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1