Extracted

• • Target

    2fdb0c9806fcf3a946a4b1194632f51feb72c33b911706c41c445b742dd394c1.elf

  • Size

    59KB

  • MD5

    c46bf457d9e1aa52b5349f3e0b9b5195

  • SHA1

    d3d259d229917928b470dd5dee0fb544d2e50ba4

  • SHA256

    2fdb0c9806fcf3a946a4b1194632f51feb72c33b911706c41c445b742dd394c1

  • SHA512

    d66f447b9d97417bfe50d8cdfad4da0a0d61381e8e183ce67b5e6b1c86bfddbad0dfef70f68059b671306de1b445736bb02b48b33d0e7637f3a7ff78a0708bbb

  • SSDEEP

    1536:2RuaDprw8bDK/eUi8w7tUXyFgyocput5+qlx2PHB:2RuMO8/Lq4gc4b+qlx2h

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (19782) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1