Extracted

• • Target
    FGx8SNCa4txePA.x86.elf
  • Size 57KB
  • SHA256 cd802c1292f083d48f3bf828b800ced643913b0b8fdab7752bd365c90cb87936
  • MD5 d84314066b650b965d98923244891e03
  • SHA1 d5ea5a70af1cb083044f2b5250e833ea4c4e0efa
  • SHA512 387943ef73017169704c4422d7073106446c9215c8c20158efd7fc20efcec18ca84db830d1860e322b5c52c1b30f3dc2c203a84ad53a2f27959216c300b03033
  • SSDEEP 1536:LSO7eO5aJD4tD2Q8ow6veIVM+P0u9gMb/EbfcGZ1SrP:LX95aJD4tD24w6zVM+su9xb/Y0IAP
  • TLSH
    T134437CC4E583E8F5DC4715B52572FB778B72F5FA1218DB43D3F86632AC92602A502A8C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  command_and_controldefense_evasiondiscovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  behavioral1