Overview

overview

10

Static

static

10

armv4l.elf

debian-9-armhf

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    armv4l.elf

  • Size

    126KB

  • Sample

    241128-wfzysavmfw

  • MD5

    90866f08bfefe79ff181f6b65a1a32b1

  • SHA1

    2db3b6b1532d15c6fa046c9472a6720c0bc383ec

  • SHA256

    616d5263976607ab8bf4ba56a840978b036b706dd81ecee7d41eb0e5bf92248d

  • SHA512

    386e5317132538e4a59b65f3a000594d3fad89bb15710f02dff710962b1ec55817937cddeeb949b879a80e78176953204846be7c1570e644a77f51094a570f80

  • SSDEEP

    3072:6jVlyaL5JCrIpv04spbttiEiTmP46aQyfPlfKsNb:yoCJCN4spbHemP46aQyfPlfKsNb

Score
10/10
gafgytdefense_evasiondiscovery

Malware Config

Targets

    • Target

      armv4l.elf

    • Size

      126KB

    • MD5

      90866f08bfefe79ff181f6b65a1a32b1

    • SHA1

      2db3b6b1532d15c6fa046c9472a6720c0bc383ec

    • SHA256

      616d5263976607ab8bf4ba56a840978b036b706dd81ecee7d41eb0e5bf92248d

    • SHA512

      386e5317132538e4a59b65f3a000594d3fad89bb15710f02dff710962b1ec55817937cddeeb949b879a80e78176953204846be7c1570e644a77f51094a570f80

    • SSDEEP

      3072:6jVlyaL5JCrIpv04spbttiEiTmP46aQyfPlfKsNb:yoCJCN4spbHemP46aQyfPlfKsNb

    Score
    7/10
    defense_evasiondiscovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks