Overview

overview

10

Static

static

10

849eab00ff...d7.elf

debian-9-armhf

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    849eab00ff07333dd09e56dcb9b3f0d7.elf

  • Size

    140KB

  • Sample

    240311-lg2hwsgf9s

  • MD5

    849eab00ff07333dd09e56dcb9b3f0d7

  • SHA1

    1a7d18289da60dd8552b16fd06ea62e6f6de14c2

  • SHA256

    5dff36c4a9ad2d2a2a0ada5b3e437b072228cf84578dfcb6469449d4da044634

  • SHA512

    c637f8bceb7bfeb6adbdc95b4ce9c6bbb80c94377612041de9645f27b63446e3bd03cd57275def1678882ed8f6593a927476f7cb4252e01a4b9067ffbe0a016c

  • SSDEEP

    3072:IbvYVCCuwCv38ZaY+lKRzziaCfjSoKGT33T7zYwMM/9CF:IbvYV5uwssZaRlKRzziZjxb3T7zRMM/i

Score
10/10
miraidiscovery

Malware Config

Targets

    • Target

      849eab00ff07333dd09e56dcb9b3f0d7.elf

    • Size

      140KB

    • MD5

      849eab00ff07333dd09e56dcb9b3f0d7

    • SHA1

      1a7d18289da60dd8552b16fd06ea62e6f6de14c2

    • SHA256

      5dff36c4a9ad2d2a2a0ada5b3e437b072228cf84578dfcb6469449d4da044634

    • SHA512

      c637f8bceb7bfeb6adbdc95b4ce9c6bbb80c94377612041de9645f27b63446e3bd03cd57275def1678882ed8f6593a927476f7cb4252e01a4b9067ffbe0a016c

    • SSDEEP

      3072:IbvYVCCuwCv38ZaY+lKRzziaCfjSoKGT33T7zYwMM/9CF:IbvYV5uwssZaRlKRzziZjxb3T7zRMM/i

    Score
    7/10
    discovery

    • Changes its process name

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Tasks