Overview

overview

10

Static

static

10

ssd.elf

debian-9-armhf

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ssd.elf

  • Size

    135KB

  • Sample

    250110-y5jn7syjeq

  • MD5

    c7212063b2e285ec072d0ab348ee208e

  • SHA1

    5f8830f178b92946bedef6f8a58a6a762792a698

  • SHA256

    58042feda2e514f3c0badf4d7c527c8bf044e21169f287b895f7fa66e5a9c7f1

  • SHA512

    b77b00b30c424c7a2892f43373a783064c174cfc6df7ab73a944d512f11cd2c0ff6c808d656a30c3f891f28f2c46920bcd611ee48cceadc9e0a2e63b7ecd8c39

  • SSDEEP

    3072:sh+Radi7iaPw5388shgZl1AzqcZRQNeN0eaLmhxQu72m/RZ:qXaPw5Rl1AzqY0eaLmhxQu72m/RZ

Score
10/10
gafgytdefense_evasiondiscovery

Malware Config

Targets

    • Target

      ssd.elf

    • Size

      135KB

    • MD5

      c7212063b2e285ec072d0ab348ee208e

    • SHA1

      5f8830f178b92946bedef6f8a58a6a762792a698

    • SHA256

      58042feda2e514f3c0badf4d7c527c8bf044e21169f287b895f7fa66e5a9c7f1

    • SHA512

      b77b00b30c424c7a2892f43373a783064c174cfc6df7ab73a944d512f11cd2c0ff6c808d656a30c3f891f28f2c46920bcd611ee48cceadc9e0a2e63b7ecd8c39

    • SSDEEP

      3072:sh+Radi7iaPw5388shgZl1AzqcZRQNeN0eaLmhxQu72m/RZ:qXaPw5Rl1AzqY0eaLmhxQu72m/RZ

    Score
    7/10
    defense_evasiondiscovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks