a81e928abed3373a2ac1ef9286a6314f1c3a5506c82f6bd458904111a685bc51

Analysis

max time kernel
74s
max time network
78s
platform
debian-9_armhf
resource
debian9-armhf-20231215-en
resource tags

arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19-02-2024 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

arm7
Size

142KB
MD5

626d4c88da2554df16c0437cc58cb676
SHA1

ab09be5abc2449b76b520000315e222a8bb9b6e0
SHA256

a81e928abed3373a2ac1ef9286a6314f1c3a5506c82f6bd458904111a685bc51
SHA512

28b17e78a7a586d38ff66583b5d5b6fccf1b517a3ff88d8dc9331a8e8726a57276d78dbecb3e03727931b8fddd2e0861aded3d3e39c81c8b5820c87d2383e1ac
SSDEEP

3072:IW2gkGgvVEaswGrW9zhO/x5K9CpWZISAoxM/9L79o:IW2godEaswGrW91O/x1YZISAeM/9lo

Score

7^/10

Malware Config

Signatures

Changes its process name 1 IoCs

Processes:

arm7

description ioc pid process

Changes the process name, possibly in an attempt to hide itself /bin/busybox 661 arm7
Enumerates running processes
Discovers information about currently running processes on the system

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	/bin/busybox	661	arm7

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

mkdirmv

description	ioc
File opened for reading	/proc/21/cmdline
File opened for reading	/proc/317/cmdline
File opened for reading	/proc/5/cmdline
File opened for reading	/proc/309/cmdline
File opened for reading	/proc/653/cmdline
File opened for reading	/proc/673/cmdline
File opened for reading	/proc/776/cmdline
File opened for reading	/proc/28/cmdline
File opened for reading	/proc/140/cmdline
File opened for reading	/proc/233/cmdline
File opened for reading	/proc/657/cmdline
File opened for reading	/proc/732/cmdline
File opened for reading	/proc/24/cmdline
File opened for reading	/proc/16/cmdline
File opened for reading	/proc/25/cmdline
File opened for reading	/proc/26/cmdline
File opened for reading	/proc/99/cmdline
File opened for reading	/proc/110/cmdline
File opened for reading	/proc/138/cmdline
File opened for reading	/proc/4/cmdline
File opened for reading	/proc/14/cmdline
File opened for reading	/proc/29/cmdline
File opened for reading	/proc/468/cmdline
File opened for reading	/proc/652/cmdline
File opened for reading	/proc/737/cmdline
File opened for reading	/proc/768/cmdline
File opened for reading	/proc/783/cmdline
File opened for reading	/proc/11/cmdline
File opened for reading	/proc/12/cmdline
File opened for reading	/proc/297/cmdline
File opened for reading	/proc/614/cmdline
File opened for reading	/proc/660/cmdline
File opened for reading	/proc/8/cmdline
File opened for reading	/proc/6/cmdline
File opened for reading	/proc/7/cmdline
File opened for reading	/proc/13/cmdline
File opened for reading	/proc/23/cmdline
File opened for reading	/proc/456/cmdline
File opened for reading	/proc/690/cmdline
File opened for reading	/proc/2/cmdline
File opened for reading	/proc/10/cmdline
File opened for reading	/proc/18/cmdline
File opened for reading	/proc/19/cmdline
File opened for reading	/proc/27/cmdline
File opened for reading	/proc/43/cmdline
File opened for reading	/proc/108/cmdline
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/15/cmdline
File opened for reading	/proc/787/cmdline
File opened for reading	/proc/9/cmdline
File opened for reading	/proc/3/cmdline
File opened for reading	/proc/149/cmdline
File opened for reading	/proc/299/cmdline
File opened for reading	/proc/664/cmdline
File opened for reading	/proc/781/cmdline
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/285/cmdline
File opened for reading	/proc/506/cmdline
File opened for reading	/proc/659/cmdline
File opened for reading	/proc/1/cmdline
File opened for reading	/proc/287/cmdline
File opened for reading	/proc/508/cmdline
File opened for reading	/proc/17/cmdline
File opened for reading	/proc/41/cmdline

Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

sh

description ioc process

File opened for modification /tmp/bin/busybox sh

description	ioc	process
File opened for modification	/tmp/bin/busybox	sh

/tmp/arm7
/tmp/arm7
1⤵
- Changes its process name
PID:661
- /bin/sh
  /bin/sh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/arm7 bin/busybox; chmod 777 bin/busybox"
  2⤵
  - Writes file to tmp directory
  PID:662
- - /bin/rm
    rm -rf bin/busybox
    3⤵
    PID:663
- - /bin/mkdir
    mkdir bin
    3⤵
    - Reads runtime system information
    PID:665
- - /bin/mv
    mv /tmp/arm7 bin/busybox
    3⤵
    - Reads runtime system information
    PID:670
- - /bin/chmod
    chmod 777 bin/busybox
    3⤵
    PID:672

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads