Overview

overview

10

Static

static

10

armv6l.elf

debian-12-armhf

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    armv6l.elf

  • Size

    174KB

  • Sample

    241204-xfrsvawjbw

  • MD5

    3d1248c7440cc303428a2546d8b2f2fd

  • SHA1

    c84ee7dc69bae0b67424c7abf45f76bc18558ae9

  • SHA256

    2d0189668bb07a0712cbf7ddc77358ff4156a48025d447bd8c42c10c0853ea47

  • SHA512

    89484e6cfe469bb3e63adfa2ae90f7f8dde3ef20b22289cc37459bbbf7cbf207ba69ff11707b0c582afdf4e792e3bf12da3fb6806b97d011c432325298e39799

  • SSDEEP

    3072:Pe1ywfQgR7Ee5ZiI/naVa1w/O/N2B1dLkHqsX43mGnWmgcygSw2EZAi:PMEyjaVa8OwdLkHqvmGnWmgcygSw2EZB

Score
10/10
gafgytdefense_evasiondiscovery

Malware Config

Targets

    • Target

      armv6l.elf

    • Size

      174KB

    • MD5

      3d1248c7440cc303428a2546d8b2f2fd

    • SHA1

      c84ee7dc69bae0b67424c7abf45f76bc18558ae9

    • SHA256

      2d0189668bb07a0712cbf7ddc77358ff4156a48025d447bd8c42c10c0853ea47

    • SHA512

      89484e6cfe469bb3e63adfa2ae90f7f8dde3ef20b22289cc37459bbbf7cbf207ba69ff11707b0c582afdf4e792e3bf12da3fb6806b97d011c432325298e39799

    • SSDEEP

      3072:Pe1ywfQgR7Ee5ZiI/naVa1w/O/N2B1dLkHqsX43mGnWmgcygSw2EZAi:PMEyjaVa8OwdLkHqvmGnWmgcygSw2EZB

    Score
    9/10
    defense_evasiondiscovery

    • Contacts a large (70535) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks