Analysis
-
max time kernel
149s -
max time network
112s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
18-10-2024 05:26
Static task
static1
Behavioral task
behavioral1
Sample
la.bot.arm7.elf
Resource
debian9-armhf-20240418-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
la.bot.arm7.elf
-
Size
77KB
-
MD5
6ea4a578d4cc9f805713981a9f55a97a
-
SHA1
6982510dc00d91da25cd3e5160c9053a4a5150e3
-
SHA256
e6dcda79ad7487e8648b5117b73bcda608829c2ebb09b17398f78145eb8f419b
-
SHA512
dbec2be2709663247f844808d9218a9a94c2586c2179ade7f8a6bdc9af67524533a146ab7438bef8d365ba133c1b46bcbff42bff158b095d2a3c34b19485c53e
-
SSDEEP
1536:6kntZ/gCIdy2t6RDHrnFtEjAKC9NRpUnpNpTI2/SImlMFigfkr5Ol:3JgCIdy2t4Fj7zXUnpNZI2d/fkr4
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog la.bot.arm7.elf File opened for modification /dev/misc/watchdog la.bot.arm7.elf -
Renames itself 2 IoCs
pid Process 638 la.bot.arm7.elf 638 la.bot.arm7.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 130.61.64.122 -
Reads process memory 1 TTPs 11 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/44/maps la.bot.arm7.elf File opened for reading /proc/55/maps la.bot.arm7.elf File opened for reading /proc/66/maps la.bot.arm7.elf File opened for reading /proc/99/maps la.bot.arm7.elf File opened for reading /proc/33/maps la.bot.arm7.elf File opened for reading /proc/22/maps la.bot.arm7.elf File opened for reading /proc/77/maps la.bot.arm7.elf File opened for reading /proc/111/maps la.bot.arm7.elf File opened for reading /proc/222/maps la.bot.arm7.elf File opened for reading /proc/444/maps la.bot.arm7.elf File opened for reading /proc/11/maps la.bot.arm7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself telnetd 638 la.bot.arm7.elf -
description ioc Process File opened for reading /proc/5555�/maps la.bot.arm7.elf File opened for reading /proc/5555�/maps la.bot.arm7.elf File opened for reading /proc/111c�"/maps la.bot.arm7.elf File opened for reading /proc/999�"/maps la.bot.arm7.elf File opened for reading /proc/1111}3/maps la.bot.arm7.elf File opened for reading /proc/1111�(/maps la.bot.arm7.elf File opened for reading /proc/666653/maps la.bot.arm7.elf File opened for reading /proc/88ll�"/maps la.bot.arm7.elf File opened for reading /proc/222i�"/maps la.bot.arm7.elf File opened for reading /proc/444s�"/maps la.bot.arm7.elf File opened for reading /proc/1111{3/maps la.bot.arm7.elf File opened for reading /proc/2222u*/maps la.bot.arm7.elf File opened for reading /proc/2222?+/maps la.bot.arm7.elf File opened for reading /proc/6666�3/maps la.bot.arm7.elf File opened for reading /proc/66664/maps la.bot.arm7.elf File opened for reading /proc/111�"/maps la.bot.arm7.elf File opened for reading /proc/222l�"/maps la.bot.arm7.elf File opened for reading /proc/222s�"/maps la.bot.arm7.elf File opened for reading /proc/2222�*/maps la.bot.arm7.elf File opened for reading /proc/2222+/maps la.bot.arm7.elf File opened for reading /proc/2222x,/maps la.bot.arm7.elf File opened for reading /proc/5555�2/maps la.bot.arm7.elf File opened for reading /proc/6666�3/maps la.bot.arm7.elf File opened for reading /proc/111c�"/maps la.bot.arm7.elf File opened for reading /proc/111�"/maps la.bot.arm7.elf File opened for reading /proc/222v�"/maps la.bot.arm7.elf File opened for reading /proc/777s�"/maps la.bot.arm7.elf File opened for reading /proc/1111�"/maps la.bot.arm7.elf File opened for reading /proc/1111�%/maps la.bot.arm7.elf File opened for reading /proc/6666�3/maps la.bot.arm7.elf File opened for reading /proc/6666�3/maps la.bot.arm7.elf File opened for reading /proc/6666�3/maps la.bot.arm7.elf File opened for reading /proc/111m�"/maps la.bot.arm7.elf File opened for reading /proc/1111�"/maps la.bot.arm7.elf File opened for reading /proc/1111�#/maps la.bot.arm7.elf File opened for reading /proc/1111|3/maps la.bot.arm7.elf File opened for reading /proc/2222I,/maps la.bot.arm7.elf File opened for reading /proc/3333/maps la.bot.arm7.elf File opened for reading /proc/3333�3/maps la.bot.arm7.elf File opened for reading /proc/222�"/maps la.bot.arm7.elf File opened for reading /proc/222�"/maps la.bot.arm7.elf File opened for reading /proc/2222 */maps la.bot.arm7.elf File opened for reading /proc/2222T,/maps la.bot.arm7.elf File opened for reading /proc/5555R/maps la.bot.arm7.elf File opened for reading /proc/5555�/maps la.bot.arm7.elf File opened for reading /proc/1111z3/maps la.bot.arm7.elf File opened for reading /proc/2222?*/maps la.bot.arm7.elf File opened for reading /proc/6666�2/maps la.bot.arm7.elf