3ad3113c6cd2bb83ca386bf997e28728768982e3d1f176bcfd788781270a0675

Analysis

max time kernel
8037s
max time network
153s
platform
debian-9_armhf
resource
debian9-armhf-20221111-en
resource tags

arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/02/2023, 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

log21.armv7.elf
Size

67KB
MD5

8d254387f162513937157f031c357725
SHA1

5e59ec4432f527ce082ef93b4e3d59d518fc1f74
SHA256

3ad3113c6cd2bb83ca386bf997e28728768982e3d1f176bcfd788781270a0675
SHA512

9191cc1ca827e0de5913d4e3dbcb82fc4cdb6a4f0bcb39d5bf9dfcf34ed9683ed929fa5700b80826136aa0541a8bbafad7101ea2eed8b2e6e8e6857c7804f631
SSDEEP

1536:ZAlRhyOvekjfNDs30nwdWI0IpEcECfLjnfGIQiDWG77:EyE/hs3TYI7ECfLTfvDt7

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (56737) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

description	ioc
/proc/net/tcp	/proc/net/tcp

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
/proc/net/tcp	/proc/net/tcp

Reads runtime system information 22 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/234/fd	/proc/234/fd	Process not Found
/proc/243/fd	/proc/243/fd	Process not Found
/proc/325/fd	/proc/325/fd	Process not Found
/proc/375/fd	/proc/375/fd	Process not Found
/proc/	/proc/	Process not Found
/proc/277/fd	/proc/277/fd	Process not Found
/proc/328/fd	/proc/328/fd	Process not Found
/proc/374/fd	/proc/374/fd	Process not Found
/proc/327/fd	/proc/327/fd	Process not Found
/proc/376/fd	/proc/376/fd	Process not Found
/proc/filesystems	/proc/filesystems	mkdir
/proc/141/fd	/proc/141/fd	Process not Found
/proc/285/fd	/proc/285/fd	Process not Found
/proc/323/fd	/proc/323/fd	Process not Found
/proc/241/fd	/proc/241/fd	Process not Found
/proc/245/fd	/proc/245/fd	Process not Found
/proc/278/fd	/proc/278/fd	Process not Found
/proc/292/fd	/proc/292/fd	Process not Found
/proc/self/exe	/proc/self/exe	log21.armv7.elf
/proc/1/fd	/proc/1/fd	Process not Found
/proc/162/fd	/proc/162/fd	Process not Found
/proc/217/fd	/proc/217/fd	Process not Found

/tmp/log21.armv7.elf
/tmp/log21.armv7.elf
1⤵
- Reads runtime system information
PID:369
- /bin/sh
  /bin/sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/log21.armv7.elf bin/watchdog; chmod 777 bin/watchdogE"
  2⤵
  PID:370
- - /bin/rm
    rm -rf bin/watchdog
    3⤵
    PID:371
- - /bin/mkdir
    mkdir "bin"
    3⤵
    - Reads runtime system information
    PID:372
- - /bin/chmod
    chmod 777 bin/watchdogE
    3⤵
    PID:373

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...