Analysis
-
max time kernel
149s -
max time network
153s -
platform
debian-12_armhf -
resource
debian12-armhf-20240418-en -
resource tags
arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
07-08-2024 06:50
Static task
static1
Behavioral task
behavioral1
Sample
arm7.elf
Resource
debian12-armhf-20240418-en
debian-12-armhf
6 signatures
150 seconds
General
-
Target
arm7.elf
-
Size
115KB
-
MD5
c3c1c6803141e720ba63cd168cc5712c
-
SHA1
40986073cff0b4ee1b7ef4ccfb3620b53bc7f174
-
SHA256
9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b
-
SHA512
2a48a05ae346ea6a6efd56c9d07501f60a304f2be6a42a9f86c0279d0a38c1777c56aa2f2aa76736469a1c9d9b7e6c431e4a0b05002dbfc304f4443dfcbfaea9
-
SSDEEP
3072:hzoMfD4gqnu9hO5gGJkkYavCMM/9WAqdz:loMfDdyu9hO57Jgav9M/9WAqdz
Score
9/10
Malware Config
Signatures
-
Contacts a large (24008) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
pid 704 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself 704 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/706/exe arm7.elf File opened for reading /proc/16/maps arm7.elf File opened for reading /proc/26/maps arm7.elf File opened for reading /proc/73/exe arm7.elf File opened for reading /proc/143/maps arm7.elf File opened for reading /proc/662/maps arm7.elf File opened for reading /proc/759/maps arm7.elf File opened for reading /proc/7/maps arm7.elf File opened for reading /proc/20/maps arm7.elf File opened for reading /proc/27/exe arm7.elf File opened for reading /proc/33/maps arm7.elf File opened for reading /proc/9/exe arm7.elf File opened for reading /proc/29/maps arm7.elf File opened for reading /proc/31/maps arm7.elf File opened for reading /proc/44/maps arm7.elf File opened for reading /proc/5/exe arm7.elf File opened for reading /proc/19/exe arm7.elf File opened for reading /proc/696/maps arm7.elf File opened for reading /proc/700/maps arm7.elf File opened for reading /proc/701/maps arm7.elf File opened for reading /proc/767/exe arm7.elf File opened for reading /proc/5/maps arm7.elf File opened for reading /proc/16/exe arm7.elf File opened for reading /proc/32/maps arm7.elf File opened for reading /proc/33/exe arm7.elf File opened for reading /proc/51/exe arm7.elf File opened for reading /proc/142/exe arm7.elf File opened for reading /proc/17/maps arm7.elf File opened for reading /proc/28/maps arm7.elf File opened for reading /proc/30/maps arm7.elf File opened for reading /proc/45/maps arm7.elf File opened for reading /proc/6/maps arm7.elf File opened for reading /proc/12/exe arm7.elf File opened for reading /proc/25/maps arm7.elf File opened for reading /proc/678/maps arm7.elf File opened for reading /proc/700/exe arm7.elf File opened for reading /proc/8/maps arm7.elf File opened for reading /proc/36/maps arm7.elf File opened for reading /proc/57/maps arm7.elf File opened for reading /proc/142/maps arm7.elf File opened for reading /proc/21/exe arm7.elf File opened for reading /proc/27/maps arm7.elf File opened for reading /proc/313/maps arm7.elf File opened for reading /proc/707/exe arm7.elf File opened for reading /proc/663/maps arm7.elf File opened for reading /proc/4/exe arm7.elf File opened for reading /proc/10/exe arm7.elf File opened for reading /proc/35/maps arm7.elf File opened for reading /proc/35/exe arm7.elf File opened for reading /proc/1/maps arm7.elf File opened for reading /proc/3/maps arm7.elf File opened for reading /proc/196/maps arm7.elf File opened for reading /proc/3/exe arm7.elf File opened for reading /proc/26/exe arm7.elf File opened for reading /proc/46/exe arm7.elf File opened for reading /proc/193/exe arm7.elf File opened for reading /proc/322/maps arm7.elf File opened for reading /proc/647/maps arm7.elf File opened for reading /proc/681/maps arm7.elf File opened for reading /proc/706/maps arm7.elf File opened for reading /proc/18/exe arm7.elf File opened for reading /proc/23/exe arm7.elf File opened for reading /proc/42/maps arm7.elf File opened for reading /proc/44/exe arm7.elf