Extracted

• • Target

    5bc6d389c73199f180528757a9d70b3cb6d71d132efa94c19719eb6928caa369.elf

  • Size

    80KB

  • MD5

    9b4ef231f25ed1f03a7dcddb4c9c24af

  • SHA1

    fb96dedc9b704274c9724f9d3a739153c5cdfe8b

  • SHA256

    5bc6d389c73199f180528757a9d70b3cb6d71d132efa94c19719eb6928caa369

  • SHA512

    2f87cac32bae9098b41ce59c9714eaa339f73ec82354bb1a898f1ec9cd35c8a49037747273645296de4dbf5e3dfc35bc9b86faa977eca960f0277b97f5197716

  • SSDEEP

    1536:k+hcm0sW9T9kgigxITXSLw27maJFrY41idxRva/JeZWbLZprtjYqRiM:TV0sW7ovaxwOLZppcqRL

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20118) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1