Extracted

• • Target

    main_arm7.elf

  • Size

    120KB

  • MD5

    dc1972800ead844f3bb071de472e3f5b

  • SHA1

    a7e6e42d49c87401cfac742764acbe70f8c3f8bb

  • SHA256

    b86b80e1a250b4737c144d48fc1fba072ef1b34ecf288ccc40efc95028db5b14

  • SHA512

    9fb0921e49c1b0f4fcb17e1c0b93a50bed23e96429bb82297620127aa704edb5441d9abed782879ac31d51f88bae1f21835827377439df105bb3ab73c9ff3d7a

  • SSDEEP

    3072:cKFpw+JlD9WGEHfEXA64gBnH25BFWnf78CM/96gziC:cKFpw+JlpDtXA64gxHpf7RM/93ziC

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (181204) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1