Extracted

• • Target
    x86.elf
  • Size 61KB
  • SHA256 91fd248d32b02f28a527c07f23449630c62ce61ae5bc37717b8b6ef51a051724
  • MD5 23be49ffd8a22d839fd34d536524e1a6
  • SHA1 828b0188146ea28cf459ee0bb6292dd4f87e3d53
  • SHA512 f803a876aad435e82fd9fbc820ab2f30fd9bb20a21e7c6bb1be84272c2ba1b7733e71794d0c67b93f21f60cd8dba53905d11cd0e22d92c90f4e0bbacb1a85683
  • SSDEEP 1536:Z7qARubgzY/bEJyxRcp+80LDHhklv4JQC9DSW:NP+eY/bEJzOXBk9AP9l
  • TLSH
    T1BF536CC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdefense_evasiondiscovery

  • Contacts a large (86424) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1