Overview

overview

10

Static

static

10

arm7.elf

debian-9-armhf

9

Analysis

  • max time kernel
    40172s
  • max time network
    153s
  • platform
    linux_armhf
  • resource
    debian9-armhf-en-20211208
  • resource tags

    arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    18-03-2023 15:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    arm7.elf

  • Size

    145KB

  • MD5

    362f9c66301cc614bd7f1ba7ab5be8ec

  • SHA1

    6da033ce9e54cd3799b145ae51bef52aacc37e4b

  • SHA256

    3dd48d1dd56840b6e37b667a81995fe861270f8e97624aecb49dbb25de6f0163

  • SHA512

    d6117f005c0b00b37c6ae55a8165fdf6ce4632cd39de86e066f7be68a047ff2db6288c5fbe3a88879aced0e722840b9eef9d6d7afa2838da5f249d5344ef8fc7

  • SSDEEP

    3072:7d8gZnSRkhcfaOUrLBdWAO6Fk4JVa0qWPATM/91jt7:7d8gZgfaOUrLBdvO6Vo0qWPEM/9Nt7

Score
9/10
discovery

Malware Config

Signatures

  • Contacts a large (35059) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/arm7.elf
    /tmp/arm7.elf
    1⤵
      PID:354
      • /bin/sh
        /bin/sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/arm7.elf bin/watchdog; chmod 777 bin/watchdog"
        2⤵
          PID:355
          • /bin/rm
            rm -rf bin/watchdog
            3⤵
              PID:357
            • /bin/mkdir
              mkdir bin
              3⤵
              • Reads runtime system information
              PID:358
            • /bin/mv
              mv /tmp/arm7.elf bin/watchdog
              3⤵
              • Reads runtime system information
              PID:359
            • /bin/chmod
              chmod 777 bin/watchdog
              3⤵
                PID:364

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads