8aff1e9e988033fcf509e995c64b2e7cd5432922a5502b43aa32bfaa6de08ed9

General

Target
8aff1e9e988033fcf509e995c64b2e7cd5432922a5502b43aa32bfaa6de08ed9.elf
Size 1.4MB
Sample260727-tcpyasbg96
SHA256 8aff1e9e988033fcf509e995c64b2e7cd5432922a5502b43aa32bfaa6de08ed9
MD5 872bc0abd4cf599d26401540ea130bfd
SHA1 4991cce0cbee3ffaa71fdb94d7fc564fe9169f3d
SHA512 efdccd4c11421aba3b1a250ff6d259354abd9b0a15bf8cb22e114eaec73f14e016fcbdf60611dba0ca88c5d19593fd10d5e17f3fc319da6ddc11c8311015cf56
SSDEEP 24576:gdAZiTnVtYiXg4vqM4L7cl3EwskCXbu4ZofxO0LvN3m3y4VMpw0x:gjMJU3EEevZkxO0h2C4VMp9
TLSH
T1976533DA38C8C2AA939E6D31CD83150DAD25F8B5A37B670C49355AA3EE0BDE701517C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  8aff1e9e988033fcf509e995c64b2e7cd5432922a5502b43aa32bfaa6de08ed9.elf
- Size 1.4MB
- SHA256 8aff1e9e988033fcf509e995c64b2e7cd5432922a5502b43aa32bfaa6de08ed9
- MD5 872bc0abd4cf599d26401540ea130bfd
- SHA1 4991cce0cbee3ffaa71fdb94d7fc564fe9169f3d
- SHA512 efdccd4c11421aba3b1a250ff6d259354abd9b0a15bf8cb22e114eaec73f14e016fcbdf60611dba0ca88c5d19593fd10d5e17f3fc319da6ddc11c8311015cf56
- SSDEEP 24576:gdAZiTnVtYiXg4vqM4L7cl3EwskCXbu4ZofxO0LvN3m3y4VMpw0x:gjMJU3EEevZkxO0h2C4VMp9
- TLSH
  T1976533DA38C8C2AA939E6D31CD83150DAD25F8B5A37B670C49355AA3EE0BDE701517C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

antivm command_and_control discovery execution persistence privilege_escalation
- Contacts a large (143968) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates Raw socket
  Creates a socket that captures raw packets at the device level
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalation
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads network interface configuration
  Fetches information about one or more active network interfaces.
  discovery
behavioral1