Analysis
-
max time kernel
148s -
max time network
150s -
platform
debian-9_armhf -
resource
debian9-armhf-20240221-en -
resource tags
arch:armhfimage:debian9-armhf-20240221-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
23/02/2024, 12:17
Behavioral task
behavioral1
Sample
arm7-20240223-1216.elf
Resource
debian9-armhf-20240221-en
General
-
Target
arm7-20240223-1216.elf
-
Size
147KB
-
MD5
935bef21805992ae65d767e294b6bda3
-
SHA1
eb5e20dc292be5a4eb7cc4f2c68b87156525f9e5
-
SHA256
51ce997fc8c2f90ae0e6a16f48db708bc6f387051225d9ef2b47b50099ad702c
-
SHA512
e0ad683f33e9707b02a7a2e20d985947625a23977e63b4fce47cd0a536d7bad6cdbf831e1ca684c50d3cfeb60dca42a2d3e4de49ba88d9896235ec63541cee2b
-
SSDEEP
3072:5J0cPOi4Th7ta9dFrRk9689TAJPii2OXkkTM/9OY:5J0cUlta9dFrRkY89oh2OXkYM/9OY
Malware Config
Signatures
-
Contacts a large (37365) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /bin/watchdog 636 arm7-20240223-1216.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/2/cmdline Process not Found File opened for reading /proc/137/cmdline Process not Found File opened for reading /proc/150/cmdline Process not Found File opened for reading /proc/768/cmdline Process not Found File opened for reading /proc/165/cmdline Process not Found File opened for reading /proc/277/cmdline Process not Found File opened for reading /proc/574/cmdline Process not Found File opened for reading /proc/28/cmdline Process not Found File opened for reading /proc/29/cmdline Process not Found File opened for reading /proc/142/cmdline Process not Found File opened for reading /proc/756/cmdline Process not Found File opened for reading /proc/761/cmdline Process not Found File opened for reading /proc/766/cmdline Process not Found File opened for reading /proc/8/cmdline Process not Found File opened for reading /proc/135/cmdline Process not Found File opened for reading /proc/649/cmdline Process not Found File opened for reading /proc/776/cmdline Process not Found File opened for reading /proc/780/cmdline Process not Found File opened for reading /proc/5/cmdline Process not Found File opened for reading /proc/23/cmdline Process not Found File opened for reading /proc/41/cmdline Process not Found File opened for reading /proc/216/cmdline Process not Found File opened for reading /proc/629/cmdline Process not Found File opened for reading /proc/634/cmdline Process not Found File opened for reading /proc/751/cmdline Process not Found File opened for reading /proc/16/cmdline Process not Found File opened for reading /proc/262/cmdline Process not Found File opened for reading /proc/285/cmdline Process not Found File opened for reading /proc/18/cmdline Process not Found File opened for reading /proc/19/cmdline Process not Found File opened for reading /proc/3/cmdline Process not Found File opened for reading /proc/7/cmdline Process not Found File opened for reading /proc/148/cmdline Process not Found File opened for reading /proc/275/cmdline Process not Found File opened for reading /proc/762/cmdline Process not Found File opened for reading /proc/770/cmdline Process not Found File opened for reading /proc/13/cmdline Process not Found File opened for reading /proc/26/cmdline Process not Found File opened for reading /proc/27/cmdline Process not Found File opened for reading /proc/313/cmdline Process not Found File opened for reading /proc/590/cmdline Process not Found File opened for reading /proc/635/cmdline Process not Found File opened for reading /proc/746/cmdline Process not Found File opened for reading /proc/15/cmdline Process not Found File opened for reading /proc/17/cmdline Process not Found File opened for reading /proc/20/cmdline Process not Found File opened for reading /proc/22/cmdline Process not Found File opened for reading /proc/74/cmdline Process not Found File opened for reading /proc/105/cmdline Process not Found File opened for reading /proc/1/cmdline Process not Found File opened for reading /proc/10/cmdline Process not Found File opened for reading /proc/14/cmdline Process not Found File opened for reading /proc/24/cmdline Process not Found File opened for reading /proc/25/cmdline Process not Found File opened for reading /proc/103/cmdline Process not Found File opened for reading /proc/279/cmdline Process not Found File opened for reading /proc/576/cmdline Process not Found File opened for reading /proc/96/cmdline Process not Found File opened for reading /proc/280/cmdline Process not Found File opened for reading /proc/623/cmdline Process not Found File opened for reading /proc/643/cmdline Process not Found File opened for reading /proc/749/cmdline Process not Found File opened for reading /proc/764/cmdline Process not Found File opened for reading /proc/filesystems mv -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/bin/watchdog sh
Processes
-
/tmp/arm7-20240223-1216.elf/tmp/arm7-20240223-1216.elf1⤵
- Changes its process name
PID:636 -
/bin/sh/bin/sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/arm7-20240223-1216.elf bin/watchdog; chmod 777 bin/watchdog��"2⤵
- Writes file to tmp directory
PID:637 -
/bin/rmrm -rf bin/watchdog3⤵PID:638
-
-
/bin/mkdirmkdir bin3⤵PID:640
-
-
/bin/mvmv /tmp/arm7-20240223-1216.elf bin/watchdog3⤵
- Reads runtime system information
PID:641
-
-
/bin/chmodchmod 777 "bin/watchdog��"3⤵PID:644
-
-