Extracted

• • Target

    x86.elf

  • Size

    72KB

  • MD5

    b5ae2b284394c0dce3fd60e72dbc802b

  • SHA1

    3617bef6ccb0e5366f56c3e0fd9a2f8e850200c4

  • SHA256

    10429d5363106d94183ed528850dde4cab8beab86c48c1367a8195a99f1c1efb

  • SHA512

    52cadb4bee67aa615472eae78d030b138467fa47fb4fa05e414078b2957c27fb70c723e257c18986864ff9030453d260699690371bb969f2b7cccffea4701b50

  • SSDEEP

    1536:b/DYQYs1ZokODichA115UzOHIt09bfsH18ruUGDKVQSi:zDhzUkODichAJUzk4090V8qbGVs

  Score

  9^/10

  discovery

  • Contacts a large (127798) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Changes its process name

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  behavioral1