Analysis
-
max time kernel
28s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
-
submitted
02-02-2025 17:32
General
-
Target
amen.arm.elf
-
Size
74KB
-
MD5
03666c3e21ab4f2b15945ff70e8a8687
-
SHA1
333317b101e12fbd98da6ff906f1bd7a20e61d55
-
SHA256
60ea8e57afee69bc5655ac527fe13c5071b4a693573772c44796e44126ef2381
-
SHA512
dd6310c25ec1c8a0828663c2314ad3c9e30ec8cd2021133681479929b74c4ee0e46e0187982eda961bd9a3576fb2d41518059f2a7f0aa2d3c26be50f5499db72
-
SSDEEP
1536:zo6MKmUUGUt+VHfIp9Dtx+gZHpVxnCIvs8Z7l5CF8a/qj68:HpmlDwHfIvrRrxnz0Oh5CF8a/qj
Malware Config
Signatures
-
Contacts a large (181446) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Traces itself 1 IoCs
Traces itself to prevent debugging attempts
-
Reads process memory 1 TTPs 22 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
-
Changes its process name 1 IoCs
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/amen.arm.elf/tmp/amen.arm.elf1⤵
- Modifies Watchdog functionality
- Traces itself
- Reads process memory
- Changes its process name
- Reads runtime system information