Analysis
-
max time kernel
0s -
max time network
126s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
resource tags
-
submitted
24-08-2022 15:13
General
-
Target
arm
-
Size
4.6MB
-
MD5
ab9781119e7ce3ecc064441b85453885
-
SHA1
a93c147609fd3527808dd06760f40464de60d804
-
SHA256
59b10e76d708320ee2a62fa62d811416f48fe3bd97149dcf8acf256940efcb54
-
SHA512
f92c9d373bdcd3b07fa4832682cf5b493d7296c8c50a308bf77bc1aa63059284abcd802a423d15f215af01ac3ffd80aa1acf0105740fec26cd319e9186ae6e77
-
SSDEEP
49152:4j9jMidSyBRoVTc8jLq3eKDrd/czUJlCCLrR1KuAb7/C:ajFdSERWTc8q3e46/C
Score
7/10
Malware Config
Signatures
-
Modifies init.d 1 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
-
Write file to user bin folder 1 TTPs 1 IoCs
-
Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/arm/tmp/arm ./arm1⤵
- Modifies init.d
- Write file to user bin folder
- Enumerates kernel/hardware configuration
- Writes file to tmp directory