Extracted

• • Target

    x86.elf

  • Size

    89KB

  • MD5

    a6711697e9f9c62231055e6fcd0f5aaa

  • SHA1

    13bf930b16482cc962a91743e93bed305b397408

  • SHA256

    3490c02550d5d70c0900ac64d14b4ef284e0ad0fae16fdb6765d1d66baade075

  • SHA512

    90b75abd44983cf89e3b9d2ff5bff05e3aca9f9d95b4dd374c783ec3d6ef52159430d40f97440cd1abf0ac5ed20fd8ae5d01f99129cecc23b4b791f5eef34946

  • SSDEEP

    1536:607w/RvCwk931F8JN5fjp7LhNSk1Q2cN9BvnaoetMP80K09lNy3owBYK1s6koEiP:60EJqwk9FFKN5fjpfSk1WBvnaoer0jNm

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (49270) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1