Overview

overview

9

Static

static

1

f332bd1819...47.elf

debian-9-armhf

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    f332bd1819ef4352e44b830be71f7a47.elf

  • Size

    69KB

  • Sample

    240318-pz7peahg2z

  • MD5

    f332bd1819ef4352e44b830be71f7a47

  • SHA1

    5bfce661e8718c51e40b0dae661ba1622f135808

  • SHA256

    ef2cf3e2ce5a59e3f5e0ee258015416cf7592a169280b3ef633fabf7d6f30f23

  • SHA512

    b2d9658a23633d0c211fa726c1f78dd05c0e22aede5487f7800d16c5453daab3bcad7da9135e0c9e9e12dd47dd96a2db7023f92f17429cdad9a15170fe90a68d

  • SSDEEP

    1536:wGnZwJ+yclUsk+5sAuj6o3qskYQpu0nmadOZqcllS5ig8b5p//1:PA+flU1+e6o6Y4u0nmadOwP8b5pH1

Score
9/10
discovery

Malware Config

Targets

    • Target

      f332bd1819ef4352e44b830be71f7a47.elf

    • Size

      69KB

    • MD5

      f332bd1819ef4352e44b830be71f7a47

    • SHA1

      5bfce661e8718c51e40b0dae661ba1622f135808

    • SHA256

      ef2cf3e2ce5a59e3f5e0ee258015416cf7592a169280b3ef633fabf7d6f30f23

    • SHA512

      b2d9658a23633d0c211fa726c1f78dd05c0e22aede5487f7800d16c5453daab3bcad7da9135e0c9e9e12dd47dd96a2db7023f92f17429cdad9a15170fe90a68d

    • SSDEEP

      1536:wGnZwJ+yclUsk+5sAuj6o3qskYQpu0nmadOZqcllS5ig8b5p//1:PA+flU1+e6o6Y4u0nmadOwP8b5pH1

    Score
    9/10
    discovery

    • Contacts a large (75229) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Changes its process name

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Renames itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks