Extracted

• • Target
    xd.arm7.elf
  • Size 138KB
  • SHA256 5e829b54fc8f09c1c443a936e3c4a4f22c360a41629a3c9bb739feae9f62ab46
  • MD5 400389df79922037d91c4b8e637fcebc
  • SHA1 b83fe7e7fdc020814f25f2d9feabdbd5ec668582
  • SHA512 df70e791fe6bc2775df8c476210216fc89e8c85fa33a5d316996d9ed9f27393d9fbda556e677f6ea431d7ec00d4a96fcee2560c45392fc3eede620bfab4c9075
  • SSDEEP 3072:+RGFWSxYqj9mrsplDKZUTQBKXAVanEX+F8JyvpB6hLm8cJBmnh1xKnGqrHpuMbKO:+RGFWgLj9mrsplDKZUTQBKXAVanEX+Fn
  • TLSH
    T19CD33B46EB408A13C0D61776FAAF41493322DB55E3EB73068D185FF43F86A9E0E67606
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (20335) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1