Extracted

• • Target
    parm7.elf
  • Size 200KB
  • SHA256 91daea9fc2e7f1f90252f7d9921bdf2783b91a0bfa96b23c994b318eb52844d2
  • MD5 adfbae053d6d2467c384d75fce3ea5d7
  • SHA1 3b67f277521cace672241856f741aa7249f2854c
  • SHA512 8574fd30acac1c0f39f40206759b8e804b8ab5d91573a3bd368bcab8f2470636ca06fb745f8317d1eadc0be5d110d89870471fe89f316f63c7b5b14981be80b5
  • SSDEEP 6144:2VsCee3Mdn+padE0c1VMTUot+il8rhpuOnMM/99ikEt:2VsCee3M5+padE0c1VIUogiSt1nN/O
  • TLSH
    T1D5143B56EA418B13C0C62B7AFA9F42453333A764D3E7330699186FB43F86B9E0E67505
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  antivmcredential_accessdefense_evasiondiscovery

  • Contacts a large (189432) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Checks hardware identifiers (DMI)

    Checks DMI information which indicate if the system is a virtual machine.

    antivm

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1