Extracted

• • Target

    notabotnet.arm7.elf

  • Size

    151KB

  • MD5

    373fc025dd0edead88d9b41fc092d777

  • SHA1

    94e1b39b1e8fd6926efb97eb1a58a44baeeab4ff

  • SHA256

    78ea113066b328c7ed16dca12cbb225b1f7a0f5e50ecea81c267e08c70e24c22

  • SHA512

    6808087542f607feaca1c3d272738fea8933fd3be69d6945ae2e23e88111fba8f1a47033142900cc53bc85b1ed8b48ae135417611839d9ff01899f9fd2530eb4

  • SSDEEP

    3072:DroWHUcCkRt52HDYq9LkK5jMXGvOBd9bwEyW68KM/91Zsf:vBUcFMH7FMXGvOBLbiW6JM/91Zsf

  Score

  9^/10

  discovery

  • Contacts a large (91137) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies the Watchdog daemon

    Malware like Mirai modify the Watchdog to prevent it restarting an infected system.

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  behavioral1