Extracted

• • Target
    uranium.arm7
  • Size 135KB
  • SHA256 ab7f3c943743308632332cf8747bc62f315b57acbdb8844c9bd42fc6b977ca13
  • MD5 567380c48defeebb8325152de6dd69be
  • SHA1 fa3c677c0ac31a5f6ee0bfa38306ccc0fb990d51
  • SHA512 d3dd4774f6238740895f89f82f3f4a413710612f1e0372bd47102c30f81dff053d228a31ab3ee4e4f8dacd4131634352ddfc45df4320d1a088165f2d20a6d593
  • SSDEEP 3072:53Auz6OTbehLh+BElUCpI3SQeTz+T0IXuGYM/9gY457m:53AuzrTCh6CpI3SPTRIXu5M/9gY457m
  • TLSH
    T105D33B86FB409A13C0D61B77FA9F424933229B54E3DB73068D185FF43F86A9A4E63509
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (40497) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1