Overview

overview

10

Static

static

10

arm7.elf

debian-9-armhf

9

Analysis

  • max time kernel
    25801s
  • max time network
    163s
  • platform
    linux_armhf
  • resource
    debian9-armhf-en-20211208
  • resource tags

    arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    03/10/2022, 08:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    arm7.elf

  • Size

    157KB

  • MD5

    503645a9de0fd85a15208544b97541c7

  • SHA1

    98babc529148e9f26acc3550650411d4be811c3f

  • SHA256

    043af53b18a37168f3b0df013f6d65f908ed00fc109de4fa5b16295210e9b77f

  • SHA512

    ddb2d01763dc19b09a07368c650093ba572a257c16799c25e67d40b07ab5ced39084c58bf84d1b16a82adee4fda099d79a896c25d4b5f86bf4d30eb8473823fd

  • SSDEEP

    3072:bPdC3mzY+/k7De7habh6i+AZ1ZFgNY71trs5u1fGM/9xrYzl3f7:bPomzY/6hal6i+AZrFgKts5u1eM/9Sdz

Score
9/10
discovery

Malware Config

Signatures

  • Contacts a large (34037) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/arm7.elf
    /tmp/arm7.elf
    1⤵
      PID:351
      • /bin/sh
        /bin/sh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/arm7.elf bin/busybox; chmod 777 bin/busybox"
        2⤵
          PID:352
          • /bin/rm
            rm -rf bin/busybox
            3⤵
              PID:354
            • /bin/mkdir
              mkdir bin
              3⤵
              • Reads runtime system information
              PID:357
            • /bin/mv
              mv /tmp/arm7.elf bin/busybox
              3⤵
              • Reads runtime system information
              PID:360
            • /bin/chmod
              chmod 777 bin/busybox
              3⤵
                PID:361

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads