Analysis
-
max time kernel
78s -
max time network
162s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
-
submitted
04-12-2024 18:49
General
-
Target
armv7l.elf
-
Size
211KB
-
MD5
285bc760ecab5891c56470914d94ab91
-
SHA1
c1ad764a3f0f5ddf046d09304c0d2bdbe801cf07
-
SHA256
53338aeaf35445d85e7f9bb3502525b1322b68b784901c9e68ff4328ee7b3c1b
-
SHA512
82f398837f1322c9cc442a45e1d244f22b563a5cb4bca8404479425017679a4bf9ae13fa514ddca63a05ac7d4e0ff54d7d8a66c30af86fddf4e5dbf8ea991ddf
-
SSDEEP
6144:jg3ULHp2atw3S9arg0oz64+/SGM/9A9Wmvt24yFJkWXi:jhLHp2atw3S9g2OLSn/gWmvt24UJkWXi
Score
9/10
Malware Config
Signatures
-
Contacts a large (70874) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/armv7l.elf/tmp/armv7l.elf1⤵
- Modifies Watchdog functionality
- Reads system routing table
- Changes its process name
- Reads system network configuration