Overview

overview

10

Static

static

10

arm

debian-9-armhf

7

Resubmissions

24-08-2022 15:13

220824-slxh3afber 10

24-08-2022 15:12

220824-sk86gafbcp 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    arm

  • Size

    4.6MB

  • Sample

    220824-slxh3afber

  • MD5

    ab9781119e7ce3ecc064441b85453885

  • SHA1

    a93c147609fd3527808dd06760f40464de60d804

  • SHA256

    59b10e76d708320ee2a62fa62d811416f48fe3bd97149dcf8acf256940efcb54

  • SHA512

    f92c9d373bdcd3b07fa4832682cf5b493d7296c8c50a308bf77bc1aa63059284abcd802a423d15f215af01ac3ffd80aa1acf0105740fec26cd319e9186ae6e77

  • SSDEEP

    49152:4j9jMidSyBRoVTc8jLq3eKDrd/czUJlCCLrR1KuAb7/C:ajFdSERWTc8q3e46/C

Score
10/10
ech0raixpersistence

Malware Config

Targets

    • Target

      arm

    • Size

      4.6MB

    • MD5

      ab9781119e7ce3ecc064441b85453885

    • SHA1

      a93c147609fd3527808dd06760f40464de60d804

    • SHA256

      59b10e76d708320ee2a62fa62d811416f48fe3bd97149dcf8acf256940efcb54

    • SHA512

      f92c9d373bdcd3b07fa4832682cf5b493d7296c8c50a308bf77bc1aa63059284abcd802a423d15f215af01ac3ffd80aa1acf0105740fec26cd319e9186ae6e77

    • SSDEEP

      49152:4j9jMidSyBRoVTc8jLq3eKDrd/czUJlCCLrR1KuAb7/C:ajFdSERWTc8q3e46/C

    Score
    7/10
    persistence

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Write file to user bin folder

    • Enumerates kernel/hardware configuration

      Reads contents of /sys virtual filesystem to enumerate system information.

    • Writes file to tmp directory

      Malware often drops required files in the /tmp directory.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks