740201329b2951b3dee53cbb8679f74050e0949e9432db1a325aeac33abd6650

Analysis

max time kernel
150s
max time network
141s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
02/02/2025, 17:32 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

arm7.b.elf
Size

120KB
MD5

2734d9008d7a36aa87b2efb102f23ff0
SHA1

fe9b50ecebc12727d264cce35aa6320edb19679a
SHA256

740201329b2951b3dee53cbb8679f74050e0949e9432db1a325aeac33abd6650
SHA512

517053e5fd0f5895c4a2b191b3a45f08f10f8b2fe42a9c337576f8f6e36cc0bcf476ea761b01ef71c82844f978cb74d407d8c53c2977f432c9c3383ecb923059
SSDEEP

1536:+SntBSk+8hwl3nlBSDx1PayWs+9xCk9lDyiuyy9kzYzmsODsZzw/9lY+h7W+hA:T0gylyx1PayWs+9tCyy9+YzhOWM/9qYG

Score

7^/10

credential_access defense_evasion

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	arm7.b.elf
File opened for modification	/dev/misc/watchdog	arm7.b.elf

Traces itself 1 IoCs

Traces itself to prevent debugging attempts

pid	Process
710	arm7.b.elf

Reads process memory 1 TTPs 12 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/708/maps	arm7.b.elf
File opened for reading	/proc/709/maps	arm7.b.elf
File opened for reading	/proc/715/maps	arm7.b.elf
File opened for reading	/proc/458/maps	arm7.b.elf
File opened for reading	/proc/614/maps	arm7.b.elf
File opened for reading	/proc/619/maps	arm7.b.elf
File opened for reading	/proc/665/maps	arm7.b.elf
File opened for reading	/proc/703/maps	arm7.b.elf
File opened for reading	/proc/461/maps	arm7.b.elf
File opened for reading	/proc/683/maps	arm7.b.elf
File opened for reading	/proc/712/maps	arm7.b.elf
File opened for reading	/proc/719/maps	arm7.b.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	fl7kwejj865ih2ekivn	710	arm7.b.elf

/tmp/arm7.b.elf
/tmp/arm7.b.elf
1⤵
- Modifies Watchdog functionality
- Traces itself
- Reads process memory
- Changes its process name
PID:710

Network

DNS

debian12-armhf-20240221-en-14

Remote address:

1.1.1.1:53

Request

debian12-armhf-20240221-en-14

IN AAAA

Response
DNS

debian12-armhf-20240221-en-14

Remote address:

1.1.1.1:53

Request

debian12-armhf-20240221-en-14

IN A

Response
DNS

debian12-armhf-20240221-en-14

Remote address:

1.1.1.1:53

Request

debian12-armhf-20240221-en-14

IN AAAA

Response
DNS

debian12-armhf-20240221-en-14

Remote address:

1.1.1.1:53

Request

debian12-armhf-20240221-en-14

IN A

Response

185.224.0.33:6075

915 B
744 B
17
14

1.1.1.1:53

debian12-armhf-20240221-en-14

dns

75 B
150 B
1
1

DNS Request

debian12-armhf-20240221-en-14
1.1.1.1:53

debian12-armhf-20240221-en-14

dns

75 B
150 B
1
1

DNS Request

debian12-armhf-20240221-en-14
1.1.1.1:53

debian12-armhf-20240221-en-14

dns

75 B
150 B
1
1

DNS Request

debian12-armhf-20240221-en-14
1.1.1.1:53

debian12-armhf-20240221-en-14

dns

75 B
150 B
1
1

DNS Request

debian12-armhf-20240221-en-14

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

DNS Request

DNS Request

DNS Request

DNS Request

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.