Extracted

• • Target
    2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b.elf
  • Size 61KB
  • SHA256 268224c90f691f970206a73410aa7c40259aa9a998e01faf983afb5c7efb7c65
  • MD5 13e3072f82f231693e0f859e5b8ae2e6
  • SHA1 9074c03d5276ebd3f2e5528570a9bc7bb016a4a4
  • SHA512 6eb30dda2fe2dfae20a0bffb690cc4d4455ec51715cadf95dc83af9b5fb2593e7a6b167f358446e26961e48fe4489997c95d1833a940d5ce2df7309086d1c916
  • SSDEEP 1536:3A9qgufLYl4g0ePQY+SWs/9aVHf3kd/Qgo/W:CqjfLYlgIQY+SWs/UVHfs47O
  • TLSH
    T1D0532AC5B193E8F5EC10097D307AAF62AEB3F13B7036DE8BD7D954739942602910629D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20489) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1