Extracted

• • Target

    ec25126c850ebac2d3f1a43773fbfb78.elf

  • Size

    59KB

  • MD5

    ec25126c850ebac2d3f1a43773fbfb78

  • SHA1

    92c18799bd01dc416f37abc812199f36cca3750e

  • SHA256

    251add4eb4e658b8dccb49053628fa80ca9ab4c5813fcd546bd62cd532555cc4

  • SHA512

    ce10c25bd68a16c63184403ab66f460263e392803eb9571ea7a9dc932fd85f81558cb7cff3a73017b0b2f750801d72550607174f822c773efe9d605465a85e6f

  • SSDEEP

    1536:IyFjHK/P+tm+6jDii/aJGMhrL2yBCECt5DmFx0o:IaY+tmGZhvZCbDmFxL

  Score

  9^/10

  discovery

  • Contacts a large (10558) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Changes its process name

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  behavioral1