Extracted

• • Target
    x86_64.elf
  • Size 202KB
  • SHA256 42632385fc419e7492bc6ea22406b93844261fb7119be9681187fd2c46612192
  • MD5 c4caa4cdf250efdb8ecfa67330df68f3
  • SHA1 8ca084ae179ffca8215a07cd341c13755d5fc4c9
  • SHA512 90b29796515cc2aee958881d08cb10742744af3471ca170290c8e950cab674f3d609b171368242675f72159bb1524dd85454f76b3177e2d9d3019ee6004c7b14
  • SSDEEP 3072:G+wyfortJ8WzCKbh8O5BrJfUAGYAQCznl9Y6vyA1vWzJUU04Q7obj:DwCortJvzCMtmfXv+OTlo
  • TLSH
    T1CF146C16B98080FFC496D1781BFEF43AE931B0AE5278725B27D49F262E4DE615B2C740
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  command_and_controldefense_evasiondiscovery

  • Contacts a large (929) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Writes file to system bin folder

  behavioral1