Extracted

• • Target

    Ghost.q.elf

  • Size

    596KB

  • MD5

    8e6961210d82ddd5bdd636bbf68593a3

  • SHA1

    9538b70c08b272fce9f3b25ff06c8828fdcb0175

  • SHA256

    34d70d58eae0338f35488d9a05ac5d703db7aa97699e9365d85e9a843d7c4979

  • SHA512

    f39142f568e4c3de66f48ba50552480a604d3a16287de0c1f14d2893c9eb0fdf39a80abcedd54294f5b8f9daf9ca62e9b08408e84a08b834ed36e905486bd85b

  • SSDEEP

    12288:rPTJS+naeW9kclFEcMWbHdxZ7GkR2fX/6y9P/YAh7Dxu9hc7D:DTJfrW99q4bHdxZ7G1fXFND4XcX

  Score

  9^/10

  persistence

  • Writes file to system bin folder

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Write file to user bin folder

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1