Analysis
-
max time kernel
22s -
max time network
33s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
08-01-2025 22:57
Behavioral task
behavioral1
Sample
army7.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
army7.elf
-
Size
302KB
-
MD5
f800aac19067dd0808e5b08b056bcf11
-
SHA1
14ebef4f03fea503330cd71255fbb1811628048b
-
SHA256
58794be45bca0f8715403decd7264070767bd5e127f8409f089f81435b3268c5
-
SHA512
0d85cd5ac1194b7676a863178d7eabec5481a553daa8b63691f298b060942111e2bfa2eaf3ca87d36da0c18c4e7a84679ca1183655d61850b435217243a1b219
-
SSDEEP
6144:3JmkqPEIC5aWGSWYZH6KIhmTMLVCdukqM/9jmi3wq09aMNS:gkKER5azSWYZaKimIZCTD/hmi3/09aMM
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog army7.elf File opened for modification /dev/misc/watchdog army7.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route army7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself sshd 643 army7.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route army7.elf -
description ioc Process File opened for reading /proc/76/cmdline army7.elf File opened for reading /proc/594/cmdline army7.elf File opened for reading /proc/664/cmdline army7.elf File opened for reading /proc/726/cmdline army7.elf File opened for reading /proc/41/cmdline army7.elf File opened for reading /proc/216/cmdline army7.elf File opened for reading /proc/739/cmdline army7.elf File opened for reading /proc/309/cmdline army7.elf File opened for reading /proc/654/cmdline army7.elf File opened for reading /proc/98/cmdline army7.elf File opened for reading /proc/109/cmdline army7.elf File opened for reading /proc/148/cmdline army7.elf File opened for reading /proc/590/cmdline army7.elf File opened for reading /proc/653/cmdline army7.elf File opened for reading /proc/705/cmdline army7.elf File opened for reading /proc/744/cmdline army7.elf File opened for reading /proc/274/cmdline army7.elf File opened for reading /proc/712/cmdline army7.elf File opened for reading /proc/714/cmdline army7.elf File opened for reading /proc/725/cmdline army7.elf File opened for reading /proc/736/cmdline army7.elf File opened for reading /proc/747/cmdline army7.elf File opened for reading /proc/749/cmdline army7.elf File opened for reading /proc/756/cmdline army7.elf File opened for reading /proc/7/cmdline army7.elf File opened for reading /proc/26/cmdline army7.elf File opened for reading /proc/628/cmdline army7.elf File opened for reading /proc/640/cmdline army7.elf File opened for reading /proc/695/cmdline army7.elf File opened for reading /proc/715/cmdline army7.elf File opened for reading /proc/716/cmdline army7.elf File opened for reading /proc/760/cmdline army7.elf File opened for reading /proc/21/cmdline army7.elf File opened for reading /proc/290/cmdline army7.elf File opened for reading /proc/321/cmdline army7.elf File opened for reading /proc/684/cmdline army7.elf File opened for reading /proc/735/cmdline army7.elf File opened for reading /proc/764/cmdline army7.elf File opened for reading /proc/693/cmdline army7.elf File opened for reading /proc/4/cmdline army7.elf File opened for reading /proc/5/cmdline army7.elf File opened for reading /proc/17/cmdline army7.elf File opened for reading /proc/28/cmdline army7.elf File opened for reading /proc/574/cmdline army7.elf File opened for reading /proc/645/cmdline army7.elf File opened for reading /proc/678/cmdline army7.elf File opened for reading /proc/701/cmdline army7.elf File opened for reading /proc/709/cmdline army7.elf File opened for reading /proc/753/cmdline army7.elf File opened for reading /proc/763/cmdline army7.elf File opened for reading /proc/638/cmdline army7.elf File opened for reading /proc/685/cmdline army7.elf File opened for reading /proc/700/cmdline army7.elf File opened for reading /proc/759/cmdline army7.elf File opened for reading /proc/680/cmdline army7.elf File opened for reading /proc/745/cmdline army7.elf File opened for reading /proc/3/cmdline army7.elf File opened for reading /proc/11/cmdline army7.elf File opened for reading /proc/659/cmdline army7.elf File opened for reading /proc/676/cmdline army7.elf File opened for reading /proc/681/cmdline army7.elf File opened for reading /proc/687/cmdline army7.elf File opened for reading /proc/708/cmdline army7.elf File opened for reading /proc/143/cmdline army7.elf