Extracted

• • Target

    Josho.x86.elf

  • Size

    44KB

  • MD5

    156084292a48f8260acabfb715b522dd

  • SHA1

    f0908c38c4124e60163f042fb45f27781696a800

  • SHA256

    c6329db058ffa575eaf0433d247a352ce854619fc1d7e69677800e9e4f49469c

  • SHA512

    a5f6fce2666394f16d3b38b74b55c036d843d6f5c9c9af8aac5edaebd69772f849a45aee315d168fffc870a8fc12b0a7702e422b7147bc0037a524e68647bb33

  • SSDEEP

    768:l8DRBUaGoT5fsz3ClcTTPyPuenlQ+ueSDWDdfUI8YHbJRihO+Yff4a:SD7UaGoT5fCylcTTEK8jSdY7JRihO+wb

  Score

  9^/10

  discovery

  • Contacts a large (39913) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Changes its process name

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  behavioral1