Overview

overview

10

Static

static

10

zmap.arm7.elf

debian-9-armhf

7

Analysis

  • max time kernel
    130s
  • max time network
    150s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    16-12-2024 15:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    zmap.arm7.elf

  • Size

    152KB

  • MD5

    a4def922ea1b16e8304da5d512303dd3

  • SHA1

    54f8320c0ef7f8fe029098cd08eb0236ff8a6e14

  • SHA256

    a7cfe20ac2b16d27cd37982305dffec84730014f4c46dc38bf674bc18f9202d5

  • SHA512

    b56c232d164b12195d9b75673330ee9e94bc18acb99b41ea4f700ffd76da6e8d59d263d40c9f764bf18bcad87c2feff917f34d488cce663c70deddd9e01fb9ed

  • SSDEEP

    3072:gXNsG9xNku0haoanAE+zRzHnbNc57VMzFLSO4PFM/9h7TBA:gXNsiEuNoanL+zRzHbNy+LS7dM/9Zy

Score
7/10
defense_evasion

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Writes file to system bin folder 2 IoCs
  • Changes its process name 1 IoCs

Processes

  • /tmp/zmap.arm7.elf
    /tmp/zmap.arm7.elf
    1⤵
    • Deletes itself
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Changes its process name
    PID:661

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads