Extracted

• • Target

    8bfbd5faf2dd2dfb76e60c14d010fbf1bcbe980950528709ceac4edc9f003c6a.elf

  • Size

    215KB

  • MD5

    8f0ef21b5de9e86fb84f39100d232d31

  • SHA1

    dc251a7d8f85c9f22dcd88cdc1db553b2414837d

  • SHA256

    8bfbd5faf2dd2dfb76e60c14d010fbf1bcbe980950528709ceac4edc9f003c6a

  • SHA512

    2e2f07bddeaad98deef73b88054af5496dcf1dc5c716e31b92689601e939c535fc11eec69306755f29aed50f768ea09c3fc34967fb770d43df1f709a499ebf04

  • SSDEEP

    6144:+dta8mHLmWskspb7HI+YnFavgBE6OCTI6c3m:+dta82xZAjsnwvgBE6OCTI6Wm

  Score

  9^/10

  discoverypersistence

  • Contacts a large (204549) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  behavioral1