Extracted

• • Target

    arm.elf

  • Size

    114KB

  • MD5

    50728716bbb3316434121160f54a0457

  • SHA1

    e2821a2d04fd8332004110a4c68a8486d4489fdd

  • SHA256

    27d13d2f3ecfa851961cceee52850b9a1a18a0acd72cd9a6c0e1d1ee13ff3715

  • SHA512

    24657ee1f98580081ef44d31cb7c38a0324f3c7bbfd3abae0ed433019fd7b9af15ae87db0259bc740b73382ea8632e5e7312397fa7de06634362769d743a5fbf

  • SSDEEP

    1536:amH6BXQ389Z+YkakZSkVTO1H+DPMnzDn6KeZWS5x5De6Qi6M5WwBNA0aCJtlxLvo:amaBXQaEOzDnlw7TdjQiJYwBFJ7vkt

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (49343) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1