3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f

General

Target
arm7
Size 1.2MB
Sample260805-g45rlsw1ft
SHA256 3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f
MD5 62802abcae18d915a106788308192def
SHA1 3273d875b4368d38f6b735b020011c19118d600f
SHA512 f902b9ae1c559d2c597ff1006c1896c937293a04446b02ead9118bdb1d171b3cfbfe8c04a05fa8fd95337ed6f0d4f76d54b400bb92745173434ce20555841f66
SSDEEP 24576:yaOwVvvYm3CwpbTqfb2tEZYclsK21F9vJLESiWiV5:y3wDTqfespsBfxJM/z
TLSH
T1E85533D67B8493DCC13CF099E908DC283CECA9248F776D04DE5148C63667BB58A58AF2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  arm7
- Size 1.2MB
- SHA256 3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f
- MD5 62802abcae18d915a106788308192def
- SHA1 3273d875b4368d38f6b735b020011c19118d600f
- SHA512 f902b9ae1c559d2c597ff1006c1896c937293a04446b02ead9118bdb1d171b3cfbfe8c04a05fa8fd95337ed6f0d4f76d54b400bb92745173434ce20555841f66
- SSDEEP 24576:yaOwVvvYm3CwpbTqfb2tEZYclsK21F9vJLESiWiV5:y3wDTqfespsBfxJM/z
- TLSH
  T1E85533D67B8493DCC13CF099E908DC283CECA9248F776D04DE5148C63667BB58A58AF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

antivm command_and_control discovery execution persistence privilege_escalation
- Contacts a large (223182) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates Raw socket
  Creates a socket that captures raw packets at the device level
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalation
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads network interface configuration
  Fetches information about one or more active network interfaces.
  discovery
behavioral1