Extracted

• • Target

    main_arm.elf

  • Size

    49KB

  • MD5

    af848b47c928f2824768a6634fd73c4f

  • SHA1

    9f288a4124f65c4494e3b636f1363d74d74a871b

  • SHA256

    c25d610eee32bedb28b991670bc77f85754fec6762eeb82dd5e467a4eaebfcb9

  • SHA512

    38d7a32301bcfa19e57cc0f5c783138fb1adea56441bf7fe9001c59b6e58e36b731c6aabf9440f3f8d8e7d28bd73895f23c75fd1d60071ce86e2cc718f9dde5f

  • SSDEEP

    768:vjXxB/BUuYxob0LZ5/Dah1mTY2xb6f3gPseN9MCN69rGLPehUD/hyB06adURR5Pc:bxB/SDXDaUMeNqCcMLg65oNIF

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (55659) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1