Extracted

• • Target
    0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf
  • Size 85KB
  • SHA256 c66f6928096cfccfbe2081c0e4bd06be1474af44c0e325e89c33debb354dde82
  • MD5 3a2fe18be54d38833fcf9916fa7d993a
  • SHA1 0fb6d9edd62d2b16d516d2dfae683d2652478e73
  • SHA512 cfd0055d5cba6a91204ca84f3575ed306e3934169a55099471d458e448c4d826586ab5e5710738495e678662c7ac08413aff775178c7d03dd07f08e469e532b6
  • SSDEEP 1536:/Z5kVIPGGxjwp44GEGEM80vUWJWvrXuBfnQnUqvmMrlDy:DhPGGxjaB0cyWKBfnQnUqvhly
  • TLSH
    T16E83944E3E219F7EFBAC823847F35A21964933DA36E1D584D15CEA021E7038A741FB95
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20141) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1