Overview

overview

9

Static

static

1

6.elf

debian-12-armhf

9

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20240221-en
  • resource tags

    arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    12/01/2025, 23:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6.elf
  • Size 106KB
  • Sample250112-2586mswpfl
  • SHA256 8b97827c5bd2bca0571e5adb550f9b4dbba90b95e467f03f1c5278953b9ff545
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
discoveryexecutionpersistenceprivilege_escalatioprivilege_escalation

Malware Config

Signatures

  • Contacts a large (61997) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Executes dropped EXE 1 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Changes its process name 1 IoCs
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 3 IoCs

    Execute scripts via Unix Shell.

    execution
  • Reads runtime system information 31 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/6.elf
    /tmp/6.elf
    1⤵
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Changes its process name
    • Reads runtime system information
    • Writes file to tmp directory
    PID:706
    • /bin/sh
      /bin/sh -c "systemctl daemon-reload > /dev/null 2>&1"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:714
      • /usr/bin/systemctl
        systemctl daemon-reload
        3⤵
        • Reads runtime system information
        PID:716
    • /bin/sh
      /bin/sh -c "crontab /tmp/crontab.tmp > /dev/null 2>&1"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:774
      • /usr/bin/crontab
        crontab /tmp/crontab.tmp
        3⤵
        • Creates/modifies Cron job
        PID:775
    • /bin/sh
      /bin/sh -c "/etc/init.d/hello > /dev/null 2>&1"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:776
      • /etc/init.d/hello
        /etc/init.d/hello
        3⤵
        • Executes dropped EXE
        PID:777

Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Unix Shell

        1
        T1059.004

        Scheduled Task/Job

        1
        T1053

        Cron

        1
        T1053.003

        Persistence

        Boot or Logon Autostart Execution

        3
        T1547

        XDG Autostart Entries

        1
        T1547.013

        Boot or Logon Initialization Scripts

        2
        T1037

        RC Scripts

        2
        T1037.004

        Create or Modify System Process

        1
        T1543

        Systemd Service

        1
        T1543.002

        Scheduled Task/Job

        1
        T1053

        Cron

        1
        T1053.003

        Privilege Escalation

        Boot or Logon Autostart Execution

        3
        T1547

        XDG Autostart Entries

        1
        T1547.013

        Boot or Logon Initialization Scripts

        2
        T1037

        RC Scripts

        2
        T1037.004

        Create or Modify System Process

        1
        T1543

        Systemd Service

        1
        T1543.002

        Scheduled Task/Job

        1
        T1053

        Cron

        1
        T1053.003

        Defense Evasion

        Credential Access

        Discovery

        Network Service Discovery

        2
        T1046

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        hello
        • Path /etc/init.d/hello
        • Size 611B
        • SHA256 e8c4684dcd4dec816220b8004215e3e6895f3ba94daf9686df2b06e4beb08d4e
        • MD5 SHA1 SHA512
        Submit Download

        hello.service
        • Path /etc/systemd/system/hello.service
        • Size 307B
        • SHA256 9ff16d5f5424c2956f45788afdd760d33c0a3fa2c6ecb26e42985a8fa240c8dd
        • MD5 SHA1 SHA512
        Submit Download

        crontab.tmp
        • Path /tmp/crontab.tmp
        • Size 128B
        • SHA256 b8e78b550d109ee15548551c810057be7aabcac9723d38f386b32ae33fd86e7a
        • MD5 SHA1 SHA512
        Submit Download

        tmp.bCGQ2s
        • Path /var/spool/cron/crontabs/tmp.bCGQ2s
        • Size 318B
        • SHA256 8356ffca5de13eb7a5f4b383f297e7a131759c3ccf2fb5ec0e9e69379ee503e9
        • MD5 SHA1 SHA512
        Submit Download