3a17d7fdc3b1c0633250e0948fd7b36b09c1cab5c4136d5e68b3713da3a4cca5 | Triage

Analysis

max time kernel
150s
max time network
156s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
30-12-2024 01:17

Sharing

Report Analysis Logs

General

Target

main_arm7.elf
Size

177KB
MD5

8f1feeeaed324cd5ce3b8af40c29b0d9
SHA1

d5464ef39861774b45ecf0b65acc7858f1cdaed0
SHA256

3a17d7fdc3b1c0633250e0948fd7b36b09c1cab5c4136d5e68b3713da3a4cca5
SHA512

f08c3ae719800009221ea6991a605dacb0b86d3a43c844611c711d33421804da5245ceab7dca6756799962dcd076a0e72cb2500bec230ee55ed75bbfd1ad8253
SSDEEP

3072:hLe6vho1QIruCee+asuTuRebU7IVIL+ZQyq8YhTfYo+M/R6yDoSn:de6vhjIr1r+asuTuReAvL+7q8+x+M/Rb

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
708	main_arm7.elf

Traces itself 2 IoCs

Traces itself to prevent debugging attempts

pid	Process
708	main_arm7.elf
709	main_arm7.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	httpd	708	main_arm7.elf

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/main_arm7.elf	main_arm7.elf

/tmp/main_arm7.elf
/tmp/main_arm7.elf
1⤵
- Deletes itself
- Traces itself
- Changes its process name
- Writes file to tmp directory
PID:708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads