c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099

Resubmissions

02-01-2025 21:33

250102-1ejbvswpcv 10

08-12-2024 01:12

241208-bkq68azkep 10

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02-01-2025 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

arm1
Size

977KB
MD5

cb75be331a7b5cb54bae9db9f4ca643d
SHA1

789ccb024361d7a4911dfc77bf1c93442491c3c9
SHA256

8366aea8087a354cbd178f920770b35d785f988ec3649bb7e282d1e3272a6b77
SHA512

d16e503bb8434c324976747b9f90092fafdaafcc877c588b18c8d1c14c9d813552389dea496a1b2cacaea4e2ebfdec6a630c68e44c645d1a25da9076e6f4c32f
SSDEEP

12288:erXiRPpwBSHJB2A6f13P5D79dmuxlNzJs4dm3yxiD1WjfGAIFDFvyq766Pd8YTQ0:jvwlP5DJdrRJsskWU5RPdg2ByWwK3R

Score

4^/10

discovery

Malware Config

Signatures

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	arm1

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/dev	arm1

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/stat	arm1
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed

/tmp/arm1
/tmp/arm1
1⤵
- Reads CPU attributes
- Reads system network configuration
- Reads runtime system information
PID:701
- /bin/sh
  sh -c "sed -i -e '/exit/d' /etc/rc.local"
  2⤵
  PID:702
- - /bin/sed
    sed -i -e /exit/d /etc/rc.local
    3⤵
    - Reads runtime system information
    PID:703
- /bin/sh
  sh -c "sed -i -e '/^ | | \$/d' /etc/rc.local"
  2⤵
  PID:706
- - /bin/sed
    sed -i -e "/^ | | \$/d" /etc/rc.local
    3⤵
    - Reads runtime system information
    PID:707
- /bin/sh
  sh -c "sed -i -e '/arm1 reboot/d' /etc/rc.local"
  2⤵
  PID:709
- - /bin/sed
    sed -i -e "/arm1 reboot/d" /etc/rc.local
    3⤵
    - Reads runtime system information
    PID:710
- /bin/sh
  sh -c "sed -i -e '2 i/tmp/arm1 reboot' /etc/rc.local"
  2⤵
  PID:715
- - /bin/sed
    sed -i -e "2 i/tmp/arm1 reboot" /etc/rc.local
    3⤵
    - Reads runtime system information
    PID:716
- /bin/sh
  sh -c "sed -i -e '2 i/tmp/arm1 reboot start' /etc/rc.d/rc.local"
  2⤵
  PID:717
- - /bin/sed
    sed -i -e "2 i/tmp/arm1 reboot start" /etc/rc.d/rc.local
    3⤵
    - Reads runtime system information
    PID:719
- /bin/sh
  sh -c "sed -i -e '2 i/tmp/arm1 reboot start' /etc/init.d/boot.local"
  2⤵
  PID:721
- - /bin/sed
    sed -i -e "2 i/tmp/arm1 reboot start" /etc/init.d/boot.local
    3⤵
    - Reads runtime system information
    PID:722

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads