Extracted

• • Target

    elitebotnet.arm5.elf

  • Size

    77KB

  • MD5

    1a8ac15cffc6f1ab25caa7ca23c599fb

  • SHA1

    1248e962ceabb211c8869217e366823450a4e0e3

  • SHA256

    2bafad36c4095ee53cc479cf621e250ae83113f502f964229359f3ef5e83ee10

  • SHA512

    17205d97399216409583627e54e44c61b8989ac92f3de53aa072c83eba3c77224de6e1121de16a18f3ce3e962a2e4c3b21949ae76a76c61a589bf7da655f47db

  • SSDEEP

    1536:aODrgViG5ZK5HK4jP72INeqshQKapV5bPQVzAvwbZnN:aODrgdMj7NeqSQKAbcAvwbZnN

  Score

  9^/10

  defense_evasiondiscoverypersistence

  • Contacts a large (23033) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  behavioral1