dc655e3fbe7077ba0bedeee36ec5490d3cb34533895847af0020d76424ba867c

General

Target

dc655e3fbe7077ba0bedeee36ec5490d3cb34533895847af0020d76424ba867c.elf
Size

71KB
Sample

241123-dkz58swres
MD5

cb252f2e42c0acc599543950f68e1c89
SHA1

cba809879f40763ee86578517cdbf3837ad69b68
SHA256

dc655e3fbe7077ba0bedeee36ec5490d3cb34533895847af0020d76424ba867c
SHA512

391ec4a4b2a940aa2aa7923454635fe65802267257e4865c331ec685db627bd554c598ce23500f108305ce03450c44100ecaa12e6d5930c023809f42286f6505
SSDEEP

1536:mCRYRPJHOYcQYpPIcd6g+yNu0Fyw0PrIbKsBnzsTij:mQQPJCQYpxd6tyNuUOrAKmnf

Score

9^/10

Malware Config

Targets

- Target
  
  dc655e3fbe7077ba0bedeee36ec5490d3cb34533895847af0020d76424ba867c.elf
- Size
  
  71KB
- MD5
  
  cb252f2e42c0acc599543950f68e1c89
- SHA1
  
  cba809879f40763ee86578517cdbf3837ad69b68
- SHA256
  
  dc655e3fbe7077ba0bedeee36ec5490d3cb34533895847af0020d76424ba867c
- SHA512
  
  391ec4a4b2a940aa2aa7923454635fe65802267257e4865c331ec685db627bd554c598ce23500f108305ce03450c44100ecaa12e6d5930c023809f42286f6505
- SSDEEP
  
  1536:mCRYRPJHOYcQYpPIcd6g+yNu0Fyw0PrIbKsBnzsTij:mQQPJCQYpxd6tyNuUOrAKmnf
Score

9^/10

credential_access defense_evasion discovery evasion
- Contacts a large (18048) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Deletes system logs
  Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
  evasion
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- Renames itself
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads process memory
  Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
  credential_access
behavioral1