Overview

overview

10

Static

static

10

4f1ab0732c...84.elf

debian-9-mips

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4f1ab0732c7d4700af91b44fd6e26a49f2b27f0039dbb3d9dce4f8cbf1cd1484.elf

  • Size

    63KB

  • Sample

    250202-ev1p7avmhx

  • MD5

    44a0a590a97dc92588fa30a3d3ee011f

  • SHA1

    879a7d609c539cd9f147737207d4b3422d0cbd06

  • SHA256

    4f1ab0732c7d4700af91b44fd6e26a49f2b27f0039dbb3d9dce4f8cbf1cd1484

  • SHA512

    bd37fa60811eff40b1a44b7cee73a7896837ea156fb7df5710d67784595a34a0b0dd3800f6595d2f868aefe76a28b25cb3155f655fffb93345d6c61593017531

  • SSDEEP

    1536:MAiCDwpTQqeHYSE3gp3LirgSkxNhYu0mv:wCDyTQ34iEgvDYTmv

Score
10/10
miraidefense_evasiondiscovery

Malware Config

Targets

    • Target

      4f1ab0732c7d4700af91b44fd6e26a49f2b27f0039dbb3d9dce4f8cbf1cd1484.elf

    • Size

      63KB

    • MD5

      44a0a590a97dc92588fa30a3d3ee011f

    • SHA1

      879a7d609c539cd9f147737207d4b3422d0cbd06

    • SHA256

      4f1ab0732c7d4700af91b44fd6e26a49f2b27f0039dbb3d9dce4f8cbf1cd1484

    • SHA512

      bd37fa60811eff40b1a44b7cee73a7896837ea156fb7df5710d67784595a34a0b0dd3800f6595d2f868aefe76a28b25cb3155f655fffb93345d6c61593017531

    • SSDEEP

      1536:MAiCDwpTQqeHYSE3gp3LirgSkxNhYu0mv:wCDyTQ34iEgvDYTmv

    Score
    9/10
    defense_evasiondiscovery

    • Contacts a large (110946) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Renames itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks