Overview

overview

10

Static

static

10

s.elf

debian-12-armhf

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    s.elf

  • Size

    135KB

  • Sample

    250105-jmjh6azkgm

  • MD5

    09748a86923870171d1821e84a4ae778

  • SHA1

    b583e96c59f11380bf6286904cb925c279f16378

  • SHA256

    ea358ee792f3c08a4b8c34cf10d1c04c9003c13d21d195d348173aa78ec4c75c

  • SHA512

    9b2cc8d791b76c901c290792161b104ea006587bb5b4d6d9595327c269c0c9bda02bbe0bd215fd1e916f029eea7a66a0c05b9fd157313b46f43e111eeee05fb6

  • SSDEEP

    3072:sh+Radi7iaPw5388shgZl1pzqcZRQNeN0eaLmhxQu72m/RZ:qXaPw5Rl1pzqY0eaLmhxQu72m/RZ

Score
10/10
gafgytdefense_evasiondiscovery

Malware Config

Targets

    • Target

      s.elf

    • Size

      135KB

    • MD5

      09748a86923870171d1821e84a4ae778

    • SHA1

      b583e96c59f11380bf6286904cb925c279f16378

    • SHA256

      ea358ee792f3c08a4b8c34cf10d1c04c9003c13d21d195d348173aa78ec4c75c

    • SHA512

      9b2cc8d791b76c901c290792161b104ea006587bb5b4d6d9595327c269c0c9bda02bbe0bd215fd1e916f029eea7a66a0c05b9fd157313b46f43e111eeee05fb6

    • SSDEEP

      3072:sh+Radi7iaPw5388shgZl1pzqcZRQNeN0eaLmhxQu72m/RZ:qXaPw5Rl1pzqY0eaLmhxQu72m/RZ

    Score
    7/10
    defense_evasiondiscovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks