Extracted

• • Target

    c2e181d4d7649f987a4326048aa8c23ac2c2789442bcfa16fb86fde86cdc2526.elf

  • Size

    93KB

  • MD5

    4d32e79b54b14fc772da04f4feaaff8f

  • SHA1

    5d1c085cebf543d112ea9ed95fd9c2e050b32f6a

  • SHA256

    c2e181d4d7649f987a4326048aa8c23ac2c2789442bcfa16fb86fde86cdc2526

  • SHA512

    7a9ca4f6c03a0549b043b75d6a98398786f3f6892e2504377c0548c63fa11b63f26f902c2600cb1a34223dac5fa03fd99515ce67c3aa99b425fce806ba4edc64

  • SSDEEP

    1536:r+sa5dL2k21r5CGrVyzIEDYLoGIq5F6+0vDFOfpwTP2VMp/piSD3j3TKZQ1Z59:Xa5dCZl5CGZIIEDIF6+0bMfplVMp/pis

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (19529) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1