5df4e0a3d22be0f4343217c58255d662ec1409c35d183bac4681d77d1e7f488c | Triage

Analysis

max time kernel
133s
max time network
154s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04-01-2025 18:25

Sharing

Report Analysis Logs

General

Target

arm7.elf
Size

188KB
MD5

d2da00b7f852fc6e9703fa9b0860fc9b
SHA1

defa63c0187a398d000dd179eb2ac820fba469e1
SHA256

5df4e0a3d22be0f4343217c58255d662ec1409c35d183bac4681d77d1e7f488c
SHA512

4cb7a42e5e1b36d02134dca65759b854bc540e7ee1230d42d6bf917e18befa37ba30eea588e33e5481a1712a1b3865187f0f4fb4f2ae58ca4a4800e5c4081bda
SSDEEP

3072:lX6y+GCzsxAXCITPGr9GeMaScsSDyWVUZp5F1pXUXooL9M/RYIVTG:lX6y+RzsxjITPgstaScsSD/aF1pXIVLV

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
650	arm7.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	httpd	648	arm7.elf

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1/cgroup	arm7.elf

/tmp/arm7.elf
/tmp/arm7.elf
1⤵
- Deletes itself
- Changes its process name
- Reads runtime system information
PID:648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads