Extracted

• • Target

    loligang.mpsl.elf

  • Size

    89KB

  • MD5

    efb7f6dceefe870a4aa7de880dd33b37

  • SHA1

    acc4512e701bb0cbc585fda70b668a3b60e8a0e3

  • SHA256

    df80f3061ca6d993c767980a8595dabd7b216644dac4795ec49e8a178145efa1

  • SHA512

    5f438b1e8c916fdb70fd297c4447bb1c2af80d92820a57354ba60805287d07652bf44bf1dbc27be1fc86ea67cb0177bb19a9919870f8c5a94a80394707f04950

  • SSDEEP

    1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZqui:qCYxrKDy46NP

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (19865) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1