Extracted

• • Target

    784db5194f8b5a98cba51ceb1af187437c183b7fec992c9b03046a85cd026271.elf

  • Size

    89KB

  • MD5

    fe1a5b3ba4f91ec8443a8fc86bf94223

  • SHA1

    c1369a22c102eeb1f053e32e144e89af6d2fb337

  • SHA256

    784db5194f8b5a98cba51ceb1af187437c183b7fec992c9b03046a85cd026271

  • SHA512

    d06780a1de1ce39bcea4aa0d7a5836c369e16358475731cee17fb3226f1af6cf6b2e345333eadbc409ece2c1003b6ac891423bfd68553af25b7ca5ff5984fe3d

  • SSDEEP

    1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZq5i:qCYxrKDy46N6

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20354) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1