Extracted

• • Target

    0fd6b0a9e7f5bc2678ad53954a89f91a6cf22e4eb1b6ee39b3f9f9acca380305.elf

  • Size

    99KB

  • MD5

    e1ab5574c2b7009c42619978671f4082

  • SHA1

    fd58774cacd014a0e3c97776e2bdf4c14c3fa8b4

  • SHA256

    0fd6b0a9e7f5bc2678ad53954a89f91a6cf22e4eb1b6ee39b3f9f9acca380305

  • SHA512

    255a8ee27fc47d29cd96b6cead0c09ea8393eec4a4c899c9ade6b77332ca5e8018f4a9f6c4da443c0727c43610c6cfa5ba823520d9a85ad44771a998cea9a77e

  • SSDEEP

    1536:HegXUnytTDLmgKQ29A0v+iRbNxcLPkXK7wYvmG6aa7GcVdJ:pvDEA0WKbNx3XK7wYv1jaicTJ

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20208) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1