Overview

overview

10

Static

static

10

jew.arm7.elf

debian-9-armhf

9

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240418-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    06/12/2024, 13:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    jew.arm7.elf

  • Size

    133KB

  • MD5

    e108df642891abdfa0d4aeed0168986c

  • SHA1

    42d39a845a8ffa441f2f170057823ab439d2c805

  • SHA256

    19db89952df90d8bb150ef0813cf9732643cc6d6a23fe765d487828d10396360

  • SHA512

    718ac35251ee90d8b32951fe49d540e148f501d151d54edf9dad15363c0e1f8bace7811a5d46305935610626ccfe54cdd59e3cee52633880db7a2a41a262c297

  • SSDEEP

    3072:5KacBqVuJVkW5IOPZoxNOqMP0wctzHn/PF+84/M/92L18Yj:kacBQuJVkW5IOaxNOqMPVo7F+8MM/9Zc

Score
9/10
defense_evasiondiscovery

Malware Config

Signatures

  • Contacts a large (116584) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Writes file to system bin folder 2 IoCs
  • Changes its process name 1 IoCs

Processes

  • /tmp/jew.arm7.elf
    /tmp/jew.arm7.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Changes its process name
    PID:645

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads