Analysis
-
max time kernel
24700s -
max time network
160s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
resource tags
-
submitted
20-09-2022 14:13
General
-
Target
notabotnet.arm7.elf
-
Size
151KB
-
MD5
373fc025dd0edead88d9b41fc092d777
-
SHA1
94e1b39b1e8fd6926efb97eb1a58a44baeeab4ff
-
SHA256
78ea113066b328c7ed16dca12cbb225b1f7a0f5e50ecea81c267e08c70e24c22
-
SHA512
6808087542f607feaca1c3d272738fea8933fd3be69d6945ae2e23e88111fba8f1a47033142900cc53bc85b1ed8b48ae135417611839d9ff01899f9fd2530eb4
-
SSDEEP
3072:DroWHUcCkRt52HDYq9LkK5jMXGvOBd9bwEyW68KM/91Zsf:vBUcFMH7FMXGvOBLbiW6JM/91Zsf
Score
9/10
Malware Config
Signatures
-
Contacts a large (91137) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Reads runtime system information 22 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/notabotnet.arm7.elf/tmp/notabotnet.arm7.elf1⤵