Extracted

• • Target
    lessie.x86.elf
  • Size 61KB
  • SHA256 6248dc18ac86b280a8a608f150567ed88e1df1dd845d3ab78bdd051a0c9cf560
  • MD5 0a253f2ee4f9e4de6a66657e4b81e199
  • SHA1 c3b8436dda650fb8be46f0eaceebafa7215e7499
  • SHA512 48acd16c91de6e6a5ba39814e5d393e49a93468e0798f5d757fc16456e6c28e2c3d84558e89cd8ba3a1e0549a9916d696625884d4bc95279bf36ff25486702a3
  • SSDEEP 1536:1Uti+GXggf/bICZtbXYlaflSWD/aQfoT5aq3C3WRp:15Xggf/bICZtbXYlatSWD/XfoT4qSmRp
  • TLSH
    T193532AC8E0E3E8F5EC14097D307A7F629EB3F13BB136E99BC7E95463A941602900625D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20606) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1