Extracted

• • Target

    0cf773711a14965c3e7f9f7d6ce6ddf680ca633b3ae815d7759fd112d9fec91c.elf

  • Size

    151KB

  • MD5

    736c31e68e569b75d420f45aa0a564a5

  • SHA1

    86c6eaa1615dad670f8d87fec928f5b1aafb2c5e

  • SHA256

    0cf773711a14965c3e7f9f7d6ce6ddf680ca633b3ae815d7759fd112d9fec91c

  • SHA512

    10474f88e041956cf286e5567ec01362e6fb480050372db1057ff6f83b8a03d57a50f3bc447d3c8e210dadb86dd85649d21603580fb07ef4af709f9a98557256

  • SSDEEP

    3072:cYuS/Hp34dNxISv4d+TfJvWa2dCAnhcJhL9H9LBQZ2jxBOCLwWvVAM/9i/ym3:cYuS/HCdgSv4d+TfJvH2dCAnhs9NBQZV

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20260) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1