Extracted

• • Target
    77e57670562d923b0f86b9b1f4e802dab2b04f82766041be259244f98ceab6a9.elf
  • Size 212KB
  • SHA256 77e57670562d923b0f86b9b1f4e802dab2b04f82766041be259244f98ceab6a9
  • MD5 5ea8b9a7e0dc2fb5c46b603f186b4c73
  • SHA1 8040525fea69ddea1cd0a9d47c1e95d9733a356f
  • SHA512 7baa7826ad4e326f27f897048d0652299863815cdde2f2285948149d4b9ac02d39860cfdb3ede995707fc6cccbcd39ac9d92c4503d408a49911125fac7d88b57
  • SSDEEP 3072:ATUQuKVkecIGF5BRTBd5WUepEMmTkjvu6+450mmjsP7vzVPfQxEo6JWKJcRYK:ATUQudBpB7WUi9XG6+9OYxGaR
  • TLSH
    T11C245C0BE99590FDC5EAC1784BFAB537D930B55D0238B21A5B94AF222E29F305B1CB41
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  credential_accessdefense_evasiondiscovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Writes file to system bin folder

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1