Extracted

• • Target
    eb9c029830935d18579ef3654d808d8360d55223869c67cd0c746bb3a609e39c.elf
  • Size 178KB
  • SHA256 e9290f77dbca2139d0fa775fd29fc03009f1e316eaa86ceef0e0b1999a564c13
  • MD5 46856c98df95f441094fee1d4f9ea0db
  • SHA1 42891dd88c32e424ac73638f0022edb3f96bd0a5
  • SHA512 b82f199cc9e3dda4e40a6031c5513111fa65803eb7f4a9c2a49fce90157ab83a778694c311dc82fc6c8640688777e24bb1a684fbc0e367e789a1ac283b33df24
  • SSDEEP 3072:wVLv6M41MTRarg2sen1ynQ9X/HOGlVeGstN8oM/93a3hsie:wVLvc4Rarg2sen0nU/uG7eGstNHM/9Km
  • TLSH
    T1C4043C46EA418A53C4C6277AFA9F414533239B64D3EB330689187FF43F86B9E0E67605
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdefense_evasiondiscovery

  • Contacts a large (222243) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1