Extracted

• • Target
    jaffacakes118_f413513476109259af44faf75d18b6c2fee0e9545967626d25126311aabb291c.bin
  • Size 125KB
  • SHA256 f413513476109259af44faf75d18b6c2fee0e9545967626d25126311aabb291c
  • MD5 f54c5ff09f23260cbd63e76d50f0e508
  • SHA1 7a0095c509ad9dcebe4499cb75c0d59cf7278525
  • SHA512 f8d8f92f1aded80bd6c5053ba61cc0e079df765caac41ad4766d158a9a169dde784ffc350752b7e762b505b7dbf05e845bedbe119c8450f102c70e1924194236
  • SSDEEP 3072:uYBOgGD1sgfH0FkKUEbq8leO1DJnvy/CS7cCM/9ADQ:ZBOgk1sSHKUMq8leO1VnoCS3M/9GQ
  • TLSH
    T1FBC32B46EA818F03C4D5177ABAEF42453323A764E3DB730699189FB43F8669F0E63905
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdefense_evasiondiscovery

  • Contacts a large (211671) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1