Extracted

• • Target

    kwari.arm.elf

  • Size

    57KB

  • MD5

    b84783800a79ecb6412a65354e4e1510

  • SHA1

    3dd659c4a29997777adccb8e9eae9ee79fb3c8b1

  • SHA256

    c607b3d8221334eafa811a539e32d4c7b6ced563a5ba87c7d3379b715478f397

  • SHA512

    73fafe900a4f9ccda86d49e3e3b0218b9889d0a59466dadb368cad07f3fc71326a31364b562d18a05c642768a76f6465dc066c2b433be3c94c29255fa0a96d78

  • SSDEEP

    1536:D9PcRxxfdqcicMnroYVbJiYOg1RIwwh+1gAL2i0Dec1aRQFO6:DhcRxx5wwEr2i/TQFv

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (345160) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  behavioral1