Overview

overview

10

Static

static

10

arm.elf

debian-9-armhf

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    arm.elf

  • Size

    77KB

  • Sample

    250219-xcgtgawndz

  • MD5

    009e48bb599ed80b52a8a5cc7bcdc975

  • SHA1

    5dfd4288668490822d98968874b39ab63e7e244a

  • SHA256

    f0b75ebd46b16f8a7b70027489bd12b1e350dc7386eddb1d85256482852deb37

  • SHA512

    af89c62c424b234dddf41f547ffe8cb896dcd4744dc4e3712fc8a45fe9124a839a561fc7d0cabfb9aa91d035e8eb0952dcd3467422c71e9eca2677f86976fe82

  • SSDEEP

    1536:Kl3kUVLABJQz6bMbru06RR8gTVYn83ahWnUuqpX5WzEF35mWG:Klt6Ag+n8qhoeXF39

Score
10/10
echobotmiraidefense_evasiondiscovery

Malware Config

Targets

    • Target

      arm.elf

    • Size

      77KB

    • MD5

      009e48bb599ed80b52a8a5cc7bcdc975

    • SHA1

      5dfd4288668490822d98968874b39ab63e7e244a

    • SHA256

      f0b75ebd46b16f8a7b70027489bd12b1e350dc7386eddb1d85256482852deb37

    • SHA512

      af89c62c424b234dddf41f547ffe8cb896dcd4744dc4e3712fc8a45fe9124a839a561fc7d0cabfb9aa91d035e8eb0952dcd3467422c71e9eca2677f86976fe82

    • SSDEEP

      1536:Kl3kUVLABJQz6bMbru06RR8gTVYn83ahWnUuqpX5WzEF35mWG:Klt6Ag+n8qhoeXF39

    Score
    9/10
    defense_evasiondiscovery

    • Contacts a large (194790) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks