Extracted

• • Target

    x86

  • Size

    45KB

  • MD5

    19a635024b9bc729d5af802987ed757c

  • SHA1

    3b1a758621ecfc9a9cb8d225b714563342149cb0

  • SHA256

    07c2afb7002ba2d4f72bea9ea784c7c12dedaa271b3d40207ff745b13768fa52

  • SHA512

    c292a912c90495bb7f6d6b882af79bc4bb4ff13509572833525d367417e73b0cce0abc033dfb68ca010f31c2484d4d5b6f5e9d51fbc84b3ce67014b5cdc7594b

  • SSDEEP

    768:c8/MjSNW4GBs82WELXamRfWzqNYeZj3hwFEwaKXg+ZdG:c8/MjSNW4GBz3ELFdNYeFhwRaKXhZdG

  Score

  9^/10

  defense_evasiondiscoveryrootkit

  • Contacts a large (23034) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Loads a kernel module

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1behavioral2behavioral3behavioral4