Overview

overview

9

Static

static

1

3.elf

debian-9-armhf

9

Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240418-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    11/01/2025, 06:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3.elf
  • Size 89KB
  • Sample250111-hnmfrsslfk
  • SHA256 f6f3543047421d73a74deaec55d59843d0b0d648569795b8df64bd1de4ffdaeb
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
discoveryexecutionpersistenceprivilege_escalatioprivilege_escalation

Malware Config

Signatures

  • Contacts a large (77991) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Executes dropped EXE 1 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Changes its process name 1 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/3.elf
    /tmp/3.elf
    1⤵
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Changes its process name
    • Reads runtime system information
    • Writes file to tmp directory
    PID:637
    • /bin/sh
      sh -c "systemctl daemon-reload > /dev/null 2>&1"
      2⤵
        PID:639
        • /bin/systemctl
          systemctl daemon-reload
          3⤵
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:641
      • /bin/sh
        sh -c "crontab /tmp/crontab.tmp > /dev/null 2>&1"
        2⤵
          PID:648
          • /usr/bin/crontab
            crontab /tmp/crontab.tmp
            3⤵
            • Creates/modifies Cron job
            PID:650
        • /bin/sh
          sh -c "/etc/init.d/hello > /dev/null 2>&1"
          2⤵
            PID:655
            • /etc/init.d/hello
              /etc/init.d/hello
              3⤵
              • Executes dropped EXE
              PID:658

        Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Scheduled Task/Job

              1
              T1053

              Cron

              1
              T1053.003

              Persistence

              Boot or Logon Autostart Execution

              3
              T1547

              XDG Autostart Entries

              1
              T1547.013

              Boot or Logon Initialization Scripts

              2
              T1037

              RC Scripts

              2
              T1037.004

              Create or Modify System Process

              1
              T1543

              Systemd Service

              1
              T1543.002

              Scheduled Task/Job

              1
              T1053

              Cron

              1
              T1053.003

              Privilege Escalation

              Boot or Logon Autostart Execution

              3
              T1547

              XDG Autostart Entries

              1
              T1547.013

              Boot or Logon Initialization Scripts

              2
              T1037

              RC Scripts

              2
              T1037.004

              Create or Modify System Process

              1
              T1543

              Systemd Service

              1
              T1543.002

              Scheduled Task/Job

              1
              T1053

              Cron

              1
              T1053.003

              Defense Evasion

              Credential Access

              Discovery

              Network Service Discovery

              2
              T1046

              System Information Discovery

              1
              T1082

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              hello
              • Path /etc/init.d/hello
              • Size 611B
              • SHA256 1f8241d1bd8649f6046072e0f2d4618b0f77dd3c6a13944c61c614c969462add
              • MD5 SHA1 SHA512
              Submit Download

              hello.service
              • Path /etc/systemd/system/hello.service
              • Size 307B
              • SHA256 2bce91ebb7090d46cd237d9910e1cbde1d2f5aa1c13057a6a44af31887f47a22
              • MD5 SHA1 SHA512
              Submit Download

              crontab.tmp
              • Path /tmp/crontab.tmp
              • Size 129B
              • SHA256 75c788f7e9f6401fbff4d848899f7e44920e8efe577c2a8e5856c3602e093322
              • MD5 SHA1 SHA512
              Submit Download

              tmp.qADVtg
              • Path /var/spool/cron/crontabs/tmp.qADVtg
              • Size 319B
              • SHA256 67064f5e80f72f00370940c258785c16abba9f8b22cd9500e374d6254804123b
              • MD5 SHA1 SHA512
              Submit Download