Overview

overview

10

Static

static

10

skyljnearm5elf.elf

debian-9-armhf

9

Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20231215-en
  • resource tags

    arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    10/01/2024, 19:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    skyljnearm5elf.elf

  • Size

    145KB

  • MD5

    2a45852dbc079011d8679a0e71f34028

  • SHA1

    78fca7aea09ccea2375817fd18a90208a7bfed91

  • SHA256

    6c264bfd4594fa8fecef25dcc55dff4e4063fa3985428ac5492700defe50239c

  • SHA512

    ddc0a5113c1bbcda39df15da8e51d497e6ab6e939a06f8c994b981d1065d5fa806b97699a104a85504aec3faffd65258d233c055a7706672e206967a57466111

  • SSDEEP

    3072:S/aWJYvEZupYV1cx4lBz7QFu1/6yY6jEtIz:S/a7PpSGx4ll7QFhyPjEk

Score
9/10
discovery

Malware Config

Signatures

  • Contacts a large (77220) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Changes its process name 1 IoCs
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/skyljnearm5elf.elf
    /tmp/skyljnearm5elf.elf
    1⤵
    • Changes its process name
    PID:653

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads