Extracted

• • Target
    .Sarm7.elf
  • Size 148KB
  • SHA256 d3bb3f8ba2a610440ba163c89564e4e5e86bfe73138957f9cd4560c000222d3c
  • MD5 c414ae38ed498cf24904793cac55fa53
  • SHA1 1bda12f3319492d5857ecb9adcf543a84ccf5aad
  • SHA512 155875d128cc55656cdc8eca37ef28a8ef48708e3b596ff603f8138a04ea961113a7651800a3a9c7a4a225c9e76722564bffa7f48dee03d54352c7182619a7eb
  • SSDEEP 3072:7Az3C2TC1aUVRgLyl/SdiHuhTPTeYMbM/9HkQZbtp:6C++aUVRgLylqd/jTeYgM/9Rtp
  • TLSH
    T1A7E33D46AA418B13C0D5177AB6EF42453323AB64D3DB73059928BFF43F8279E0E67506
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  command_and_controldefense_evasion

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control

  • Traces itself

    Traces itself to prevent debugging attempts

  • Writes file to system bin folder

  behavioral1