Extracted

• • Target
    x86.elf
  • Size 155KB
  • SHA256 137bf467e6e97d3780f3f75b3c44c89c222c738cce38f4a0e69f42a440ba6fd9
  • MD5 6f6d00735299d81a446aa4ae6defd489
  • SHA1 76787be67d3f4e784e0e2b5a2a394666816c60cd
  • SHA512 72f0b107de2a2430199160d08ea49d56bf6a04c908fb2bc232c68fcfaa57f1b6ae6d1c688d499f8e277685a84638ec07a24fae319665474adbcda437331faa60
  • SSDEEP 3072:JLIxaXdi+w3TIeF4hXxBaX593ReY2aSrIvwPzQ+P+:JLIxaXM+2RF4dkRB2+wPz5P+
  • TLSH
    T188F37D80F353E2F6E84705B0617BEB339A359556111BEDC2D374DF35EC62902CA1AA9C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  command_and_controldefense_evasiondiscovery

  • Contacts a large (928) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Writes file to system bin folder

  behavioral1