Extracted

• • Target
    023782pler.arm7
  • Size 219KB
  • SHA256 a532a072687f5bd6f8f4c2fb1ce899a5d3c4264453fe2e7bafc270e83661c893
  • MD5 910dad794d959fc4a6c8063a6c6c91f5
  • SHA1 35ae9bcfc1d9cb0f73d70ae287005d390efb885a
  • SHA512 e7f0d1e3498886ccf249a0bc879b0a5fa58bc8123063664779d75febbbf2b49fa643084d3830c4de0244907bd0e38f22aa2a93e6be2b855fa90559ac25b40cc7
  • SSDEEP 6144:aidWes4aDOYZGO2kRhtcGPkiu5hM/9tEty:aiIes4aDOYZGO2kbeVXG/h
  • TLSH
    T1EC246E46EA408E13C1D617BAB69F524A33339764D3EB73069D286FB4378679E0E77201
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

  • Contacts a large (340585) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1