Extracted

• • Target

    Josho.arm7

  • Size

    125KB

  • MD5

    697af4fdb36ab70a86ab2694dd58ba57

  • SHA1

    6af72a1f205a2dda8eec78626a45bac9a4df8cd0

  • SHA256

    0fb69d16da153a3fb2cfc2314299986401098eba16c85f71c081716255b1df65

  • SHA512

    3d81b93b8d53f6eeda486a43713cd5faee65c1eefeee77757215ad6aa5c31c54a246e1ebde0c36e628c81a9d33dce0d0255602daac824f0b52418050a0680af2

  • SSDEEP

    3072:IZMu4C+u2dLhLRE90bYK5h9T96NOV+5/YtM/9gM/:eMu4C+u+RfbYK5hb6k+5/AM/9gM/

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (140051) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1