9709f5f5bd7b670a2a79d309c1110b25ffe81a5b06aaf90dd0a3a3701907a046

General

Target
reaver.mips.elf
Size 73KB
Sample260828-ybyw2asvbv
SHA256 9709f5f5bd7b670a2a79d309c1110b25ffe81a5b06aaf90dd0a3a3701907a046
MD5 59677766df78c5b7936dd302f999687d
SHA1 ca480c3ea30b194ce80bce4c27bd1f81b4b19a99
SHA512 a2e8d308d7d96521030af790abb14d6f50381a9955e4b3c324af4f3734428f6b3f9b762931fd002a3b78cb8df772774fbe19a4d0418b1f09c42f52d8933450a2
SSDEEP 1536:r1ttD5VVZegaJRrhiwTOzlXP1aMRjlV++wU6cnFrV1c2:r1tt/VIxhFCzXRH+nWJV19
TLSH
T1A573027A280541F0CE6BC67CC0AD4364ADFC173FE297CA46B7D149D78A4C0DB56C6A89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  reaver.mips.elf
- Size 73KB
- SHA256 9709f5f5bd7b670a2a79d309c1110b25ffe81a5b06aaf90dd0a3a3701907a046
- MD5 59677766df78c5b7936dd302f999687d
- SHA1 ca480c3ea30b194ce80bce4c27bd1f81b4b19a99
- SHA512 a2e8d308d7d96521030af790abb14d6f50381a9955e4b3c324af4f3734428f6b3f9b762931fd002a3b78cb8df772774fbe19a4d0418b1f09c42f52d8933450a2
- SSDEEP 1536:r1ttD5VVZegaJRrhiwTOzlXP1aMRjlV++wU6cnFrV1c2:r1tt/VIxhFCzXRH+nWJV19
- TLSH
  T1A573027A280541F0CE6BC67CC0AD4364ADFC173FE297CA46B7D149D78A4C0DB56C6A89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery exection execution persistence privilege_escalation upx
- Modifies the dynamic linker configuration file
  Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.
  exection persistence privilege_escalation defense_evasion
- Deletes itself
- Modifies the /etc/hosts DNS resolution file
  Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalation
- Creates/modifies environment variables
  Creating/modifying environment variables is a common persistence mechanism.
  persistence privilege_escalation defense_evasion
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Modifies init.d
  Adds/modifies system service, likely for persistence.
  persistence
- Modifies rc script
  Adding/modifying system rc scripts is a common persistence mechanism.
  persistence
- Modifies systemd
  Adds/ modifies systemd service files. Likely to achieve persistence.
  persistence privilege_escalation
- Modifies Bash startup script
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1