95de15b8fc652d35e7be3169c2bae76bb347d4f35fd547b31e5f3e4697a65a90

Analysis

max time kernel
0s
max time network
153s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
29-12-2024 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

arm6l.elf
Size

127KB
MD5

d1c4c00fba7ba4e0606b10fea3c4132d
SHA1

f83bedecd5953577853d73059036eee16c03f4e7
SHA256

95de15b8fc652d35e7be3169c2bae76bb347d4f35fd547b31e5f3e4697a65a90
SHA512

b07382d2352df0e48b628ae88381c9e6b794462e8dbbaf2ddcda3a03a4af89184da155c05c2cbbf7c9c4d778a357618950b88f7c709ae8bc703ce46a342304c4
SSDEEP

3072:hmfdWmd6pUeQKbcISIadimWA2PKj2Gx45hA6qcW8umy/QsYJ0Yj/:Y3IadimiGK5hA6qZmy/QsYJ0Yj/

Score

7^/10

Malware Config

Signatures

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/resolv.conf	arm6l.elf

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	703	arm6l.elf

/tmp/arm6l.elf
/tmp/arm6l.elf
1⤵
- Writes DNS configuration
- Changes its process name
PID:703

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Adversary-in-the-Middle

T1557

Discovery

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads