Extracted

• • Target
    arm7
  • Size 148KB
  • SHA256 3e410601878cdc7f91971dabb0e083694cb0d4a4f8cffd63e535edb28c27f365
  • MD5 13baebdbe1f5d6f2d60ef9528ac353da
  • SHA1 94ea09c059e6619ada962d01e5076e4747cfc166
  • SHA512 0ce84688b416f4b61233b9562078fc6e42fc8aa194595fb7f735d10395b6aefed3cb0f878e78f5ab7328de93c4567e7cb39e0d31ac4e7dd62ee743a37e78fb37
  • SSDEEP 3072:zv77jvmI47aSDV2u4AUDjNLPMvEn3ExYM/9QzjTf:73Kj7aSDV2uJUDpQEn3EmM/9QvTf
  • TLSH
    T1C2E35C46EA808E03C4D61776BAAF424933239754D3DB73068D28AFB43F87B9E4E67505
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdefense_evasiondiscovery

  • Contacts a large (86430) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1