Extracted

• • Target

    693dc90a119eaa8f3cc5354b5d907739c41eeee91c8a2b51888527ce26c1de08.elf

  • Size

    77KB

  • MD5

    267f49f4b6f2f885169c534de4348b8c

  • SHA1

    020c03acdb619c6e0af37272dcc4c6f96a29802a

  • SHA256

    693dc90a119eaa8f3cc5354b5d907739c41eeee91c8a2b51888527ce26c1de08

  • SHA512

    a723cbf06bde712bbcfbb51525df551dcd1a0c3ed64c18dcb5f91129a9e3eb42861bb916593e6be867fd5ff266bbce8a9b9e73d444da9027e91eaf9162aef540

  • SSDEEP

    1536:G4Z8LUay6+vl/R1KIdysUmR9EiYHXw6tGxZKTDJjzETd:B6ry6+vdGIdysUKqGxZUDBzId

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (23350) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1