Extracted

• • Target

    nklmpsl.elf

  • Size

    67KB

  • MD5

    8b0befb4dc3bcd729a1532e8a1833e09

  • SHA1

    908733bf3cc880b09386a578d9c3d62dbd0163fa

  • SHA256

    fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f

  • SHA512

    0da0f3fd3c691f0d7b19977962961f4e6cdcc42bde47ac8fdc087e91c9fc0eb660c0b764b7a9a8b293cc1296065ef3a39cb1f83af4f72b3f407837cf4d019b1d

  • SSDEEP

    768:/5FfwfG+uy2OM1mLsaJjvTXk02XFo08OoB5EzeLneZReggk1Lt2KXiWUrzkW:/5FIe+uyBMQE97oBqqncRVgk1LE7z

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (145238) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Renames itself

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1