Extracted

• • Target

    nabx86.elf

  • Size

    34KB

  • MD5

    a772569a4d256423bd1c03ca65a63edd

  • SHA1

    4240d67b0b700cd83b221f518cafca21c48ce50b

  • SHA256

    049941c6c5af46bf841f6c74df053d9863f1e9b3f1badf93c7e5c1ff390dd834

  • SHA512

    cfffe530fcb2f53cc4bfc935110c931140f1359ab32453e1d2591bfd341367f22212208436be962091dff90bedf0122ed1934795983c3486f6b5e0223f553218

  • SSDEEP

    384:fVcMy41Py+KevyMeTZEKS6oBHEUUyTu1zxUHWwYRKKfIDis3x1d2yL1lgS9BmXOU:Yn+TgTZ2t4+HWwOUhXVLpmXOH9n/

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (14796) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Renames itself

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1