Extracted

• • Target
    main_arm7
  • Size 177KB
  • SHA256 9517c95d736579963374276fe45955a73129e3cf23a5821fb34e61cecc800a59
  • MD5 a78cd1059025faee6ee5980118a39e65
  • SHA1 cdb8955af8c9e263de16032c9b5b8c33d676940d
  • SHA512 121be225afa325711a22e36d0fd7fdca0371bf4e448d630b80290a9d89b1ccdae5ec95e836ff8664c75bd88b686b78ecc428d99f5072316cc9c5977af223da13
  • SSDEEP 3072:OzeSvtfD84oALv2eEQakGzORuGMzw99LHd38YhTfYo+M/RM+FDhdLn:2eSvJvoA7TEQakGzORuBGLHd38+x+M/z
  • TLSH
    T1F9042945EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F22A05
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  command_and_control

  • Deletes itself

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control

  • Traces itself

    Traces itself to prevent debugging attempts

  behavioral1