Analysis
- max time kernel
149s - max time network
149s - platform
debian-9_armhf - resource
debian9-armhf-20240729-en - resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
15/12/2024, 09:51
Behavioral task
behavioral1
Sample
main_arm.elf
Resource
debian9-armhf-20240729-en
4 signatures
150 seconds
General
- Target main_arm.elf
- Size 130KB
- Sample241215-lvjj8sslfr
- SHA256 9dc918709324a4b120d8811d3fe7e6fc75ec2ef02a2ea0166ad93f2c2f7a53e7
- MD5 1abbfe1b6c9f7c51a59fd60bfeec77a8
- SHA1 3ce4b9e95625ebbd7e472ab6a56a5eaf7c64e709
- SHA512 8839f3513e4b2a18c09fa7d0f49b0940fec0aa653e5bf052cfe0c0f7c48df997b0c5b1d1ecb7281e0ae69ac9b4171e43b913e8d90d3e77609909df2781164c81
- SSDEEP 1536:wKdzElm18uZJNb4AeFa8eAZHk4VB7fzTTfHh+gYSvvqeqZfB20ly+wyw6RNP8TG+:wKp50BU8e947LPHh+zS6thBZ6xKo
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 645 main_arm.elf - Traces itself 2 IoCs
Traces itself to prevent debugging attempts
pid Process 645 main_arm.elf 646 main_arm.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 645 main_arm.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/main_arm.elf main_arm.elf