Extracted

• • Target
    arm7
  • Size 253KB
  • SHA256 a42bc2b1c97c01e02a96622e68631a75c9d74939d56bd73c61877110c97c37d2
  • MD5 1ee2408f8eaef7626591a9e5bbb45108
  • SHA1 810bc3e737e8553b3f674502ac628b901278c1d0
  • SHA512 3a4615c8430b9d7604af5e0b6a0487ab910c611f2e4fa4b0077f779ee986011da1ec7ac03f0016399078f2053112ece25e2fac20b766ea76f96df8970b465af7
  • SSDEEP 6144:hVYvAZ8sBaI6ERrJGibBfKauyFYTsQgeXGtR5KFo6M/RvUmiU22IMpTxM:HYvAZxaqJ9BfKauyFYTskcR0oD/9Umif
  • TLSH
    T155443A46EA418B13C0C717B9B6EF42453333A76493DB73069A14AFB43BC779A4F26606
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  command_and_controldefense_evasiondiscovery

  • Contacts a large (976) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Writes file to system bin folder

  behavioral1