Extracted

• • Target

    splmpsl.elf

  • Size

    74KB

  • MD5

    307165bfa9fdd0f10ddc4ce2b02116b6

  • SHA1

    916398aef92071b40dd16d3512c2fc365e71a0f3

  • SHA256

    373bfd3607320c5a7019353e020b6f6f00e035671ef75d76473ca5c92577e102

  • SHA512

    26c6df9a3b383f7132cee6ff3428881700f277f439b6666f70cbee518d4572e6d8d7902462738e21c2cadc20b9bd607e6811fe954a19c354297b9b89f2f4de2a

  • SSDEEP

    1536:1a1bQWaJus8f90gHiuEdOXUeEQS8AW6zxzNQy0Na:1WUWaJus8fOxOXUeUQg

  Score

  9^/10

  credential_accessdefense_evasiondiscovery

  • Contacts a large (44077) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Renames itself

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1