Extracted

• • Target

    2b3e78ef550aed901c5db26c42cd63b2478438dd38ad8d4e362ed8ad7b44d682.elf

  • Size

    98KB

  • MD5

    f5a84b55d9b4fd8726ee896a9a07f2ef

  • SHA1

    6576ffd041556ff8fe6fdb5a72c9bf2dffb389f5

  • SHA256

    2b3e78ef550aed901c5db26c42cd63b2478438dd38ad8d4e362ed8ad7b44d682

  • SHA512

    7f0543e970eb527caa8404a2f225775ac91864087d1f31ec2ca803830b5b3f5fb4980d2ced130d4bed9569e51ce11002ee60d6ab88aaea501fe37d75d099a20d

  • SSDEEP

    1536:fe5wX6cZjjKXcMz2Y80v6WKtmfbA7X09EYxcOKeoRhn:eQjM80yxtJ7X09EYxcOjoTn

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20280) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1