Analysis
-
max time kernel
125s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
-
submitted
06/12/2024, 07:01
General
-
Target
main_arm.elf
-
Size
49KB
-
MD5
af848b47c928f2824768a6634fd73c4f
-
SHA1
9f288a4124f65c4494e3b636f1363d74d74a871b
-
SHA256
c25d610eee32bedb28b991670bc77f85754fec6762eeb82dd5e467a4eaebfcb9
-
SHA512
38d7a32301bcfa19e57cc0f5c783138fb1adea56441bf7fe9001c59b6e58e36b731c6aabf9440f3f8d8e7d28bd73895f23c75fd1d60071ce86e2cc718f9dde5f
-
SSDEEP
768:vjXxB/BUuYxob0LZ5/Dah1mTY2xb6f3gPseN9MCN69rGLPehUD/hyB06adURR5Pc:bxB/SDXDaUMeNqCcMLg65oNIF
Malware Config
Signatures
-
Contacts a large (182175) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 31 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/main_arm.elf/tmp/main_arm.elf1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information