Extracted

• • Target
    nullnet_load.x86.elf
  • Size 65KB
  • SHA256 f89d25a12a3642fc6493fdb10967afb4d7ff12dcec9ddd4b5c4343e03aed97c1
  • MD5 5fca2ee0e1210dc42996b2826e94dc1f
  • SHA1 ad97142bafee07ca083aae3656789a50a55ee0b3
  • SHA512 fb6383b2c89a58f9f1f73d1fb8f0eb5ae7aef437b3c7c95e613cc9a578f236c0d428f7ddcaa8ce478dd30e09ea711ad57a0585cc4ff3fdbc82f98748d7f1dc10
  • SSDEEP 1536:dnA1GL2BeQAvXLfmYM0GTm4JnSzKY/0HckpTiCicD2gt:y1GKBefz+70G64J4KY/JSN
  • TLSH
    T1A2534BC9A593E8F5EC090A712173FF758576F23F216DEC87E3A499A2AC42103D1162ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdefense_evasiondiscovery

  • Contacts a large (114479) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1