Extracted

• • Target
    onie_x86_64
  • Size 181KB
  • SHA256 f0fac0f22f107252ea48d5293e51b6760e091988bc5921974b3691f0eb81274f
  • MD5 391c21544cf9a35749b78e485e93f121
  • SHA1 fe7abd2b65021954bde997981604296b6807eae2
  • SHA512 dde542c8117fb5d45e1fdd8cdb7f2ba04079a7b75b013d2e3e1446e9b23b4a43dfad03a15435bf8215d2ac3b9763d9c3a34c692748de85dc1e66493bb656ca1e
  • SSDEEP 3072:6m1mal/Mof1sjYGeO5tsx3WNcc/qheU5wLlXwl4eRcY:6YmalkoiDQjV4Ic
  • TLSH
    T1A204170AB8C0C4FDC495C1744BBEF536EA31B19D1638724B3788AF2E1E0DE605B6DA95
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  defense_evasiondiscovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Traces itself

    Traces itself to prevent debugging attempts

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1