Overview

overview

9

Static

static

1

6.elf

debian-9-armhf

9

Analysis

  • max time kernel
    149s
  • max time network
    160s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    10/01/2025, 23:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6.elf
  • Size 101KB
  • Sample250110-3wpw3stmex
  • SHA256 4f3a6d9daa6c9b92a5d8bd69ff6c3e1ec86f365d8dfa72fa2733dffe6e4c48f4
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
discoveryexecutionpersistenceprivilege_escalatioprivilege_escalation

Malware Config

Signatures

  • Contacts a large (74126) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Changes its process name 1 IoCs
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 4 IoCs

    Execute scripts via Unix Shell.

    execution
  • Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/6.elf
    /tmp/6.elf
    1⤵
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Changes its process name
    • Reads runtime system information
    • Writes file to tmp directory
    PID:652
    • /bin/sh
      /bin/sh -c "systemctl daemon-reload"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:655
      • /bin/systemctl
        systemctl daemon-reload
        3⤵
        • Enumerates kernel/hardware configuration
        PID:657
    • /bin/sh
      /bin/sh -c "systemctl start hello.service"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:664
      • /bin/systemctl
        systemctl start hello.service
        3⤵
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:666
    • /bin/sh
      /bin/sh -c "crontab /tmp/crontab.tmp"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:670
      • /usr/bin/crontab
        crontab /tmp/crontab.tmp
        3⤵
        • Creates/modifies Cron job
        PID:673
    • /bin/sh
      /bin/sh -c "update-rc.d hello defaults"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:677
      • /usr/sbin/update-rc.d
        update-rc.d hello defaults
        3⤵
          PID:679
          • /usr/local/sbin/systemctl
            systemctl daemon-reload
            4⤵
              PID:683
            • /usr/local/bin/systemctl
              systemctl daemon-reload
              4⤵
                PID:683
              • /usr/sbin/systemctl
                systemctl daemon-reload
                4⤵
                  PID:683
                • /usr/bin/systemctl
                  systemctl daemon-reload
                  4⤵
                    PID:683
                  • /sbin/systemctl
                    systemctl daemon-reload
                    4⤵
                      PID:683
                    • /bin/systemctl
                      systemctl daemon-reload
                      4⤵
                      • Enumerates kernel/hardware configuration
                      • Reads runtime system information
                      PID:683

              Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    Unix Shell

                    1
                    T1059.004

                    Scheduled Task/Job

                    1
                    T1053

                    Cron

                    1
                    T1053.003

                    Persistence

                    Boot or Logon Autostart Execution

                    3
                    T1547

                    XDG Autostart Entries

                    1
                    T1547.013

                    Boot or Logon Initialization Scripts

                    2
                    T1037

                    RC Scripts

                    2
                    T1037.004

                    Create or Modify System Process

                    1
                    T1543

                    Systemd Service

                    1
                    T1543.002

                    Scheduled Task/Job

                    1
                    T1053

                    Cron

                    1
                    T1053.003

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    3
                    T1547

                    XDG Autostart Entries

                    1
                    T1547.013

                    Boot or Logon Initialization Scripts

                    2
                    T1037

                    RC Scripts

                    2
                    T1037.004

                    Create or Modify System Process

                    1
                    T1543

                    Systemd Service

                    1
                    T1543.002

                    Scheduled Task/Job

                    1
                    T1053

                    Cron

                    1
                    T1053.003

                    Defense Evasion

                    Credential Access

                    Discovery

                    Network Service Discovery

                    2
                    T1046

                    System Information Discovery

                    1
                    T1082

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    hello
                    • Path /etc/init.d/hello
                    • Size 577B
                    • SHA256 938c4776c86d276cd90108891bd1ebd3956f975ef72455650125a4a1ac7c0a11
                    • MD5 SHA1 SHA512
                    Submit Download

                    hello.service
                    • Path /etc/systemd/system/hello.service
                    • Size 192B
                    • SHA256 29fdffdc00502051660741b307ecfc9f70ac74c71d28277c0f3aa21d6cc89539
                    • MD5 SHA1 SHA512
                    Submit Download

                    crontab.tmp
                    • Path /tmp/crontab.tmp
                    • Size 85B
                    • SHA256 30d5128d28df8615692d8d630a801ab84344e4c37239564bb3699e53f780d241
                    • MD5 SHA1 SHA512
                    Submit Download

                    tmp.YcqEKW
                    • Path /var/spool/cron/crontabs/tmp.YcqEKW
                    • Size 275B
                    • SHA256 87a883a0dc0b7c1b2a3ee5a39fa13430b6164077e4d23ffe9961070395ed5267
                    • MD5 SHA1 SHA512
                    Submit Download