Extracted

• • Target
    Fantazy.i686.elf
  • Size 60KB
  • SHA256 dc8626842cd1c53c2e02eae80e4e635bda5d9921a3553236e090e50a41313db0
  • MD5 b5cf0ad64138fb5a699bad5de4f74d08
  • SHA1 ee797892676e24b506e8120feed1d5ae50d2c255
  • SHA512 8e17cfbc68c153318b9af6e1b3b191f0f5d624fa523eecc5dd3b7d447a72a9b2b95a943752b911d297c668da5baf0babb0631723170109a9009e21c79dc14d4c
  • SSDEEP 1536:+8tlDaAbLfE/YkNlvFU329Txh3zIh22b8:+8tleH/Yn329TP3zIhfb8
  • TLSH
    T1D4533C85F5C385F6C81B4938A0DBB37FC631D9A94031599EEF8BAE36D63BA41011239D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdefense_evasiondiscovery

  • Contacts a large (23687) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1