c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099

Resubmissions

02/01/2025, 21:33

250102-1ejbvswpcv10

08/12/2024, 01:12

241208-bkq68azkep10

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/01/2025, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
arm1
Size 977KB
Sample250102-1ejbvswpcv
SHA256 8366aea8087a354cbd178f920770b35d785f988ec3649bb7e282d1e3272a6b77
MD5 cb75be331a7b5cb54bae9db9f4ca643d
SHA1 789ccb024361d7a4911dfc77bf1c93442491c3c9
SHA512 d16e503bb8434c324976747b9f90092fafdaafcc877c588b18c8d1c14c9d813552389dea496a1b2cacaea4e2ebfdec6a630c68e44c645d1a25da9076e6f4c32f
SSDEEP 12288:erXiRPpwBSHJB2A6f13P5D79dmuxlNzJs4dm3yxiD1WjfGAIFDFvyq766Pd8YTQ0:jvwlP5DJdrRJsskWU5RPdg2ByWwK3R
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

discovery

Malware Config

Signatures

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	arm1

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/dev	arm1

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/stat	arm1
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed

/tmp/arm1
/tmp/arm1
1⤵
- Reads CPU attributes
- Reads system network configuration
- Reads runtime system information
PID:701
- /bin/sh
  sh -c "sed -i -e '/exit/d' /etc/rc.local"
  2⤵
  PID:702
- - /bin/sed
    sed -i -e /exit/d /etc/rc.local
    3⤵
    - Reads runtime system information
    PID:703
- /bin/sh
  sh -c "sed -i -e '/^ | | \$/d' /etc/rc.local"
  2⤵
  PID:706
- - /bin/sed
    sed -i -e "/^ | | \$/d" /etc/rc.local
    3⤵
    - Reads runtime system information
    PID:707
- /bin/sh
  sh -c "sed -i -e '/arm1 reboot/d' /etc/rc.local"
  2⤵
  PID:709
- - /bin/sed
    sed -i -e "/arm1 reboot/d" /etc/rc.local
    3⤵
    - Reads runtime system information
    PID:710
- /bin/sh
  sh -c "sed -i -e '2 i/tmp/arm1 reboot' /etc/rc.local"
  2⤵
  PID:715
- - /bin/sed
    sed -i -e "2 i/tmp/arm1 reboot" /etc/rc.local
    3⤵
    - Reads runtime system information
    PID:716
- /bin/sh
  sh -c "sed -i -e '2 i/tmp/arm1 reboot start' /etc/rc.d/rc.local"
  2⤵
  PID:717
- - /bin/sed
    sed -i -e "2 i/tmp/arm1 reboot start" /etc/rc.d/rc.local
    3⤵
    - Reads runtime system information
    PID:719
- /bin/sh
  sh -c "sed -i -e '2 i/tmp/arm1 reboot start' /etc/init.d/boot.local"
  2⤵
  PID:721
- - /bin/sed
    sed -i -e "2 i/tmp/arm1 reboot start" /etc/init.d/boot.local
    3⤵
    - Reads runtime system information
    PID:722

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads