Analysis
-
max time kernel
0s -
max time network
34s -
platform
debian-9_armhf -
resource
debian9-armhf-20221111-en -
resource tags
arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
28-02-2023 07:31
Behavioral task
behavioral1
Sample
arm6.bin
Resource
debian9-armhf-20221111-en
debian-9-armhf
3 signatures
60 seconds
General
-
Target
arm6.bin
-
Size
154KB
-
MD5
f277e6e0674764d9e3a4c70a91d1c59e
-
SHA1
ac1c4a6b77ebffd7c2183aef65ee55c9f8eec6e1
-
SHA256
e08581747f4ea2e550f87c76e5b92fb389eb1d37a35d7fd23b6ca347603109f8
-
SHA512
ebe10e352fadce4b8b310ee091958f5a32a151ad70f3eebf819a2bbd5ba85c39b9f46c11d50891148d4996a1b7276e5001f7a53425ad24194766823802e54818
-
SSDEEP
3072:LSdcECL4GHmQWFL19MVuar5YODm1UUetJ8au49QuhsauFn8aabOmEqnF56y/mxo6:CLfMsa1GUUetJ8au4l+8aabOm1myzQ0U
Score
7/10
Malware Config
Signatures
-
Modifies rc script 1 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
Processes:
arm6.bindescription ioc process /etc/rc.d/rc.local /etc/rc.d/rc.local arm6.bin -
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
Processes:
arm6.bindescription ioc process /proc/net/route /proc/net/route arm6.bin -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
arm6.bindescription ioc process /proc/net/route /proc/net/route arm6.bin