Overview

overview

10

Static

static

10

jade.arm7.elf

debian-12-armhf

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    jade.arm7.elf

  • Size

    150KB

  • Sample

    240712-p9twaswhlh

  • MD5

    4d5649d2c3452ab2866cc2ad8c8b7cec

  • SHA1

    e8e43f2a9b933dd5b59ed1fa019f31e41ff3ddff

  • SHA256

    5b28de05094666be0ae7c9e5bc80549ea29e6bdf438b28b1eea2cdf4396fc756

  • SHA512

    e32276a8e1ced2ccba86f66d5512cb4636611e7d2b1ed83a00456ca7df77d0e888e6a35cffb83b6154757560df3f09d64f0119fecee16b7c55383c20dbfab8b1

  • SSDEEP

    3072:iQHlfs+lezFwa6JiBUdKwH5m3m7phtcDfXfMYM/9Wj3We:iQFfsuen6KwH5m3mdhYXfLM/9GWe

Score
10/10
echobotmiraidiscovery

Malware Config

Targets

    • Target

      jade.arm7.elf

    • Size

      150KB

    • MD5

      4d5649d2c3452ab2866cc2ad8c8b7cec

    • SHA1

      e8e43f2a9b933dd5b59ed1fa019f31e41ff3ddff

    • SHA256

      5b28de05094666be0ae7c9e5bc80549ea29e6bdf438b28b1eea2cdf4396fc756

    • SHA512

      e32276a8e1ced2ccba86f66d5512cb4636611e7d2b1ed83a00456ca7df77d0e888e6a35cffb83b6154757560df3f09d64f0119fecee16b7c55383c20dbfab8b1

    • SSDEEP

      3072:iQHlfs+lezFwa6JiBUdKwH5m3m7phtcDfXfMYM/9Wj3We:iQFfsuen6KwH5m3mdhYXfLM/9GWe

    Score
    9/10
    discovery

    • Contacts a large (395611) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks