Analysis
-
max time kernel
9309s -
max time network
127s -
platform
debian-9_armhf -
resource
debian9-armhf-20221111-en -
resource tags
arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
27-02-2023 11:33
Behavioral task
behavioral1
Sample
[A4-TL].elf
Resource
debian9-armhf-20221111-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
[A4-TL].elf
-
Size
252KB
-
MD5
bd872b0c4e26a915777a2745ceb03e01
-
SHA1
8cfd4e2cbae240bbd7903cf325afe50888705ccb
-
SHA256
f3c8c03a23b7a068a19624ff315850f95d0c7df4ee979c6819545300d9ed7899
-
SHA512
79e097212b39bf97a3d9f686aca3d3f0af4d6a71097aae2739742359087c2fa8740d833dc7f8bc20bc41be595e3ead64c1a78184161c509f0c6ab24fc1786f50
-
SSDEEP
6144:6V1Tvhr0NasK1i06F+GgQTCzB12I7Bxgmp5rwh6qkRpxPa:MVINasPb+G/212sjgmDwh6qkR/a
Score
9/10
Malware Config
Signatures
-
Writes file to system bin folder 1 TTPs 8 IoCs
description ioc /bin/login /bin/login /sbin/dhclient /sbin/dhclient /bin/bash /bin/bash /sbin/agetty /sbin/agetty /bin/dash /bin/dash /bin/cp /bin/cp /bin/date /bin/date /bin/mv /bin/mv -
Write file to user bin folder 1 TTPs 12 IoCs
description ioc /usr/sbin/rsyslogd /usr/sbin/rsyslogd /usr/sbin/sshd /usr/sbin/sshd /usr/bin/dpkg /usr/bin/dpkg /usr/bin/dirname /usr/bin/dirname /usr/bin/apt-get /usr/bin/apt-get /usr/bin/flock /usr/bin/flock /usr/sbin/cron /usr/sbin/cron /usr/sbin/agent /usr/sbin/agent /usr/bin/apt-config /usr/bin/apt-config /usr/bin/basename /usr/bin/basename /usr/bin/cmp /usr/bin/cmp /usr/bin/dbus-daemon /usr/bin/dbus-daemon -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process /proc/377/maps /proc/377/maps Process not Found /proc/380/cmdline /proc/380/cmdline Process not Found /proc/401/cmdline /proc/401/cmdline Process not Found /proc/446/cmdline /proc/446/cmdline Process not Found /proc/449/maps /proc/449/maps Process not Found /proc/74/maps /proc/74/maps Process not Found /proc/284/maps /proc/284/maps Process not Found /proc/284/cmdline /proc/284/cmdline Process not Found /proc/323/maps /proc/323/maps Process not Found /proc/395/maps /proc/395/maps Process not Found /proc/398/maps /proc/398/maps Process not Found /proc/413/cmdline /proc/413/cmdline Process not Found /proc/424/cmdline /proc/424/cmdline Process not Found /proc/18/cmdline /proc/18/cmdline Process not Found /proc/41/maps /proc/41/maps Process not Found /proc/476/cmdline /proc/476/cmdline Process not Found /proc/480/cmdline /proc/480/cmdline Process not Found /proc/19/maps /proc/19/maps Process not Found /proc/27/maps /proc/27/maps Process not Found /proc/96/cmdline /proc/96/cmdline Process not Found /proc/136/maps /proc/136/maps Process not Found /proc/370/cmdline /proc/370/cmdline Process not Found /proc/385/maps /proc/385/maps Process not Found /proc/43/cmdline /proc/43/cmdline [A4-TL].elf /proc/self/cmdline /proc/self/cmdline Process not Found /proc/486/maps /proc/486/maps Process not Found /proc/397/maps /proc/397/maps Process not Found /proc/410/maps /proc/410/maps Process not Found /proc/387/cmdline /proc/387/cmdline Process not Found /proc/472/maps /proc/472/maps Process not Found /proc/472/cmdline /proc/472/cmdline Process not Found /proc/491/maps /proc/491/maps Process not Found /proc/501/cmdline /proc/501/cmdline Process not Found /proc/43/maps /proc/43/maps Process not Found /proc/285/maps /proc/285/maps Process not Found /proc/10/cmdline /proc/10/cmdline Process not Found /proc/409/maps /proc/409/maps Process not Found /proc/448/cmdline /proc/448/cmdline Process not Found /proc/465/maps /proc/465/maps Process not Found /proc/4/cmdline /proc/4/cmdline [A4-TL].elf /proc/134/cmdline /proc/134/cmdline [A4-TL].elf /proc/410/cmdline /proc/410/cmdline Process not Found /proc/415/maps /proc/415/maps Process not Found /proc/423/cmdline /proc/423/cmdline Process not Found /proc/479/cmdline /proc/479/cmdline Process not Found /proc/490/maps /proc/490/maps Process not Found /proc/498/maps /proc/498/maps Process not Found /proc/42/maps /proc/42/maps Process not Found /proc/405/maps /proc/405/maps Process not Found /proc/385/cmdline /proc/385/cmdline Process not Found /proc/396/maps /proc/396/maps Process not Found /proc/411/maps /proc/411/maps Process not Found /proc/461/cmdline /proc/461/cmdline Process not Found /proc/465/cmdline /proc/465/cmdline Process not Found /proc/468/maps /proc/468/maps Process not Found /proc/17/maps /proc/17/maps Process not Found /proc/106/maps /proc/106/maps Process not Found /proc/243/cmdline /proc/243/cmdline Process not Found /proc/375/cmdline /proc/375/cmdline Process not Found /proc/376/maps /proc/376/maps Process not Found /proc/378/maps /proc/378/maps Process not Found /proc/394/maps /proc/394/maps Process not Found /proc/431/cmdline /proc/431/cmdline Process not Found /proc/12/cmdline /proc/12/cmdline Process not Found