4fff6cad45bd8353368d894d2e849cfa09d6eb10e69a204217bc1fa5714cd7b5 | Triage

Analysis

max time kernel
137s
max time network
159s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04-01-2025 16:30

Sharing

Report Analysis Logs

General

Target

arm.elf
Size

142KB
MD5

8d2258d8155f7ec37f43bb235dee351b
SHA1

fabc5df4e26d2ed71d49f6492f98bf01731e63f0
SHA256

4fff6cad45bd8353368d894d2e849cfa09d6eb10e69a204217bc1fa5714cd7b5
SHA512

d13e45ae3c64e6ce6af118572f7110915a943120b59f20d3b3df46cd388c2b13933bebc3531354ebb66086669ebc0f8f9abfc39af546040f099dfc4824038a57
SSDEEP

1536:XDbo9b0IRaSE4jf6vp54BEAsI84VhnoT62mH6lOOZdXl6a8xh7lSEwywyw0c/zeO:XDbHSnMpKBEz4Hou2mabXl5EVk

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
652	arm.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	httpd	651	arm.elf

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1/cgroup	arm.elf

/tmp/arm.elf
/tmp/arm.elf
1⤵
- Deletes itself
- Changes its process name
- Reads runtime system information
PID:651

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads