Extracted

• • Target

    hold.arm5.elf

  • Size

    73KB

  • MD5

    dbbfc41101d281284181405fb3bda5f4

  • SHA1

    02a937721a417d37ca224a2a442eb66f69b423a1

  • SHA256

    c37ed482dc4f51a198ebec5cbce5ccb03a7d591a108f5f6e3b3c96a388661314

  • SHA512

    f99d0c13a37577d977ddca337f869e8ab146b56e1fbb232ef33404434619b32f66b32dc70ce524f9eb6c4b0c8054171068b54b3ed201e698e028a30d0cdfd689

  • SSDEEP

    1536:xsvvmvVQbZ+vtxeGdZsmWVMN7x7WrFnqbO3nbf1xP+OUO:xsvvFzoZsmWVMWnq2j103O

  Score

  7^/10

  defense_evasiondiscovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1