Extracted

• • Target
    62e3e86a7586174df485af5936639769971cfc62fd9d0f2d5385d5bfa61ea88c.elf
  • Size 196KB
  • SHA256 62e3e86a7586174df485af5936639769971cfc62fd9d0f2d5385d5bfa61ea88c
  • MD5 bc1104e03642bdd52152153fc2ab034a
  • SHA1 9220783442521f6a5bc074c176ae9c2a0e0a0a92
  • SHA512 25031746d34644ca957a262d466f64e723731f9029947a1827bba239a539fc92c09e51b03b769a26637f24ba4c7fa177a318baa3048203ba5371937b866cae29
  • SSDEEP 6144:5kokjZbjptQ4ayUysO+CtzypnCBeGt3/M/Rvx3C:5kokjZhtQ4ayUysO+42wH3E/58
  • TLSH
    T124141A46E6404B13C0D727B9FADF42453333ABA4D7E773069528AFB43F8679A4E22605
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  credential_accessdefense_evasiondiscoveryexecution

  • Deletes itself

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Traces itself

    Traces itself to prevent debugging attempts

  • Writes DNS configuration

    Writes data to DNS resolver config file.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1