Extracted

• • Target

    e922a38abc64c121d674193dab862396310ee58ae2664785f47c16ceb7158175.elf

  • Size

    152KB

  • MD5

    7899ed04d9194bd0f68f16bf7fa93214

  • SHA1

    b337f65bb5bec90d19546073b8c0eae5e4597865

  • SHA256

    e922a38abc64c121d674193dab862396310ee58ae2664785f47c16ceb7158175

  • SHA512

    e7c9c0a90c4ffd06a1131757e559670d36a733a75dd298629e3c5685be497a6b6e7fb4861122bb108bcd829fd02fe0f4b9d95b09ec87a3d39206a23aff147ab8

  • SSDEEP

    3072:8B/ubqit5P9RVoRyapenH+9mrsplDKZU2QBKXAVanxX+F8JyvrT+hLBA4emlEBDU:8B/ubqit5P9noRyapeH+9mrsplDKZU23

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20462) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1