Extracted

• • Target

    arm7.elf

  • Size

    168KB

  • MD5

    f79e1a6215aa503b778a36ae1d9adebd

  • SHA1

    9c07d0922b3c30fccfc31cf335e459008817de3c

  • SHA256

    312e3eb0decead7f6c7bc08ccb39ebbf05a5f2013ed909883666ca91b9f11f4e

  • SHA512

    278a1fceb4fb4f86c62bea4b1bb520f744725380e650563bddcd0bf458743dd3eb46cbe2254bf4b1fd5880c324ffce10f46c51d0c4dbd9e15bd3c48276fa44b4

  • SSDEEP

    3072:UzZWl31/Tszb5Z16GayLZHjQQdfGtjv3vsgWIgzYBJM/9FCyPY:UzZW8z1Z0GayLZHjQQRGtjsDIgzYrM/+

  Score

  7^/10

  credential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1