Extracted

• • Target

    DEMONS.arm.elf

  • Size

    54KB

  • MD5

    c246332a7b5042960a29708f9f324664

  • SHA1

    21348c9f81e6500c99c82bc744a055a9ebecc338

  • SHA256

    1898b15ba52ab75f36b0b68201ff0a5823c4383a9204b76292854417be137e74

  • SHA512

    944967a2d68c7427b387bfc81ce92480746343f3de58cf729f299678e12ab7febdd178eb867ccfcb750f370ce8f86e82c5b1608d7d12f4397d50948338d8bbb5

  • SSDEEP

    1536:wXe9WaJ9833g2c90d9IcjNI62xPYB71/5sP1:wXYWyCc90TIQp2xyR6P1

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (387177) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1