5e94cd2e6f5bdc88863b36958af0620bcb46573827aba19832fdf3094953aedd | Triage

Analysis

max time kernel
150s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29-12-2024 12:47

Sharing

Report Analysis Logs

General

Target

main_arm5.elf
Size

126KB
MD5

3e6dedab9398ffe8ff5cbda8e59bf8e4
SHA1

253100b1f1fc00ba0b8aeca2ad84f87b1f03c0eb
SHA256

5e94cd2e6f5bdc88863b36958af0620bcb46573827aba19832fdf3094953aedd
SHA512

5925ebb00796637f83b42989d7c0e049bb35d1fe1d1e7bf9b6ab40ff299623a9b1d2bbc6e37e099d002b0459cfbda36fb765d4303b4194bc239a925f246be915
SSDEEP

3072:pKaprMh7EOXWFh4UX0AFcO5ZupvWVXeN:pK7RXgh4UEAFcuZupeVXeN

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
652	main_arm5.elf

Traces itself 2 IoCs

Traces itself to prevent debugging attempts

pid	Process
652	main_arm5.elf
653	main_arm5.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	httpd	652	main_arm5.elf

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/main_arm5.elf	main_arm5.elf

/tmp/main_arm5.elf
/tmp/main_arm5.elf
1⤵
- Deletes itself
- Traces itself
- Changes its process name
- Writes file to tmp directory
PID:652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads