Extracted

• • Target
    morte.arm7.elf
  • Size 399KB
  • SHA256 1356b4bcb55023916682b6e44aeae22e04b3605d8692525b72dfce6ed327f690
  • MD5 7b6002e04bd57edf53c5c8e61954fdbc
  • SHA1 911bdcef10b03bc48603853a39067e740a19e294
  • SHA512 c5e1fdad6c4601d7d2b8c1d782c8ca353f1ec5f898a96925aa6d1e49bb2dc7dd76dd0771bc8daa6fc12e8e44df76a14a98160264de600bf684f81533b58d1fbb
  • SSDEEP 6144:WkFEG2as5jz9YVqjiluRjoiH4XA/M/9fJx7M4:WEn2as5jz9YVekyjNHxU/nxV
  • TLSH
    T11D949713D9118991E0654CF3226B3245B94787BB8AE732D3ED1A4EB1BF2151F42BBEC1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (95402) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1