Extracted

• • Target

    wanna.arm.elf

  • Size

    80KB

  • MD5

    326a298debabe47b99add477947c84e3

  • SHA1

    aaf2dcfc14bf51388be1a68ba73b52b2b0cea1ee

  • SHA256

    dd597f1c80048578089c6a2235c51cf0d6936a87aefd06bab91cf11c8c5409a2

  • SHA512

    5197ba585faaad24bfab6d56570a18bafb9a75cdea93ec7c01fa3d08b6cac1269a3de227a26008c7030198b6353006c36efdb5a67091228a9a395549902a70da

  • SSDEEP

    1536:k+hcm0sW9T9kgigxITXSLw27maJFrY41idxRva/JeZWbLZprtjYqRyM:TV0sW7ovaxwOLZppcqR7

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20380) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1