d61e85f0ebb52fd7c8ccffcffdc9b9d437ad5e64c06d23d69c95c835286387fd

Analysis

max time kernel
0s
max time network
2s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29-12-2024 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

armv4l.elf
Size

113KB
MD5

e16ee7aa765eda6e562ca86e08c9945b
SHA1

052f6f651d95608d861a163da08f9de329947374
SHA256

d61e85f0ebb52fd7c8ccffcffdc9b9d437ad5e64c06d23d69c95c835286387fd
SHA512

028504d6c85657710235d12e8da7cfe5e0e0e1cfa13557a31125853f3a1275d8cf60a8041c8e74e54c5fc9cacb558d5f1fc53fb5a56e475e75b4916cb9cdd9f9
SSDEEP

3072:lqDUOulvQ+nozmrCppEDtkLWE5h8MbKZlrDoeZNV7YHQQ/hVOmAD3m:0pEcWE5h8MbK97YHQQ/hVOmAD3m

Score

7^/10

Malware Config

Signatures

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/resolv.conf	armv4l.elf

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	645	armv4l.elf

/tmp/armv4l.elf
/tmp/armv4l.elf
1⤵
- Writes DNS configuration
- Changes its process name
PID:645

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Adversary-in-the-Middle

T1557

Discovery

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads