Extracted

• • Target

    nklarm7.elf

  • Size

    72KB

  • MD5

    c8ba1406bbdf0a762644ec1eb79f1f95

  • SHA1

    4c77cb4e6c88c4477c61fb8296e154979901a862

  • SHA256

    12b6950a5105e5b3e4396ba1f84f4ede143da225cb7d33b12860742ed2bb12e7

  • SHA512

    ebddc6ee098af6e9030cc027a746c646d298fb5244b693131d0cf9abf909610b2bee1a3643bafafc92c4897a00263c7f68c596796640ea68af45ebb98642b60b

  • SSDEEP

    1536:JBnSqeBG3AXdo//H7vJv4oOhUX4yautS6yPimg9E9ljaiHHw6LR5:peA3z/fSoO6oyautS6yPimX7w6t

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (183599) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Renames itself

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  behavioral1