Overview

overview

10

Static

static

10

arm7.elf

debian-9-armhf

9

Analysis

  • max time kernel
    0s
  • max time network
    153s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20221111-en
  • resource tags

    arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    03/03/2023, 13:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    arm7.elf

  • Size

    147KB

  • MD5

    4e72692f8ac28260d51cbb22bf399815

  • SHA1

    af9b48f7a63dc6c60e51b583d4aaa9e538d2a030

  • SHA256

    8c152109fc1bf0eb013ce93a7b37eaf49bf7b595b9c9b0f983834cddc5760463

  • SHA512

    6b26817113519b077f020d5d8a8894bc1582106760e9541ecab2f0e3443d554cad61132e9f6bae3017ac6d520c4e6a1698fd7c1c7d1faae828793803613a4864

  • SSDEEP

    3072:yJTc2PBSpmr7Oabvzj4dlRsh8ZQIldUMXkkTM/9zY:yJTcGXOabvzj4dLsh8/UMXkYM/9zY

Score
9/10
discovery

Malware Config

Signatures

  • Contacts a large (35347) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/arm7.elf
    /tmp/arm7.elf
    1⤵
      PID:364
      • /bin/sh
        /bin/sh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/arm7.elf bin/busybox; chmod 777 bin/busybox"
        2⤵
          PID:365
          • /bin/rm
            rm -rf bin/busybox
            3⤵
              PID:367
            • /bin/mkdir
              mkdir bin
              3⤵
              • Reads runtime system information
              PID:368
            • /bin/mv
              mv /tmp/arm7.elf bin/busybox
              3⤵
              • Reads runtime system information
              PID:369
            • /bin/chmod
              chmod 777 bin/busybox
              3⤵
                PID:374

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads