Extracted

• • Target
    0d1c0c547ff6ad0d5e649eb3e7c0354136ee19841c6a7efba4d2a90597260bdf.elf
  • Size 54KB
  • SHA256 0d1c0c547ff6ad0d5e649eb3e7c0354136ee19841c6a7efba4d2a90597260bdf
  • MD5 c8d03328fa2d2d10800b9b31b52c0b45
  • SHA1 cbcc393fcb8a6c355aebb6e727b849d0d2621ed7
  • SHA512 c88c9625ed658f4ec2300058e9729f0304201ae54e360fbe0f3f2718d77d52974736d4bb3d618d31e35459c4d297f8d0518c7e29c96eae31a95a5c24f94963bd
  • SSDEEP 1536:36Ew7hWCbZ6OzptrGP85wXypWTF+bt+Rc:C1W4Z6OzP4NXypWp+bQK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  9^/10

  discovery

  • Contacts a large (11831) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  behavioral1