d761ae38684f805fd09725a77aeb65ead2b807a023d0d7de3f8c0148d0355d69

Analysis

max time kernel
142s
max time network
147s
platform
debian-12_armhf
resource
debian12-armhf-20240418-en
resource tags

arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
22/02/2025, 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hoodlum.arm6.elf
Size

139KB
MD5

6f351c4bf02ac3ad8450c60ba15fdbdc
SHA1

13551e83e841067672693fea3f1af0f905ef3d70
SHA256

d761ae38684f805fd09725a77aeb65ead2b807a023d0d7de3f8c0148d0355d69
SHA512

eb6cb8ec276a8e612dfb0e6f355aa6bbc41b6ef1fd1f3ec140a6475eb305eb3e9327b6e29ef04ec69d11e89007868d6d95a6222b3b3f9a707c8761000e3409de
SSDEEP

3072:p7dxHETIJTWhmXUI8ma3xXVuu9KrKedP5hwf254Khh6myPQaS+pg7e:pAI8ma3xX4dP5hwf2ymyPQaSGg7e

Score

7^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Deletes Audit logs 1 TTPs 1 IoCs

Deletes logs related to the Linux Audit framework.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/audit/audit.log	rm

Deletes itself 1 IoCs

pid	Process
707	hoodlum.arm6.elf

Deletes journal logs 1 TTPs 4 IoCs

Deletes systemd journal logs. Likely to evade detection.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/journal/65779e181e584f059cb9deb1099989c3/system.journal	rm
File deleted	/var/log/journal/65779e181e584f059cb9deb1099989c3/[email protected]~	rm
File deleted	/var/log/journal/65779e181e584f059cb9deb1099989c3/system@f4ab1fd584a0407e8c8403ee6219da04-00000000000003bf-0006165f9985f81e.journal	rm
File deleted	/var/log/journal/65779e181e584f059cb9deb1099989c3	rm

Flushes firewall rules 1 TTPs 6 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
777	iptables
778	iptables
780	systemctl
780	systemctl
780	systemctl
780	systemctl

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/resolv.conf	hoodlum.arm6.elf

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
734	rm

Deletes log files 1 TTPs 30 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/journal	rm
File deleted	/var/log/exim4	rm
File deleted	/var/log/lastlog	rm
File deleted	/var/log/apt/term.log	rm
File deleted	/var/log/installer/firmware-summary	rm
File deleted	/var/log/installer	rm
File deleted	/var/log/private	rm
File deleted	/var/log/apt	rm
File deleted	/var/log/installer/hardware-summary	rm
File deleted	/var/log/alternatives.log	rm
File deleted	/var/log/apt/history.log	rm
File deleted	/var/log/installer/cdebconf/templates.dat	rm
File deleted	/var/log/installer/cdebconf/questions.dat	rm
File deleted	/var/log/installer/partman	rm
File deleted	/var/log/runit	rm
File deleted	/var/log/audit	rm
File deleted	/var/log/installer/status	rm
File deleted	/var/log/dpkg.log	rm
File deleted	/var/log/btmp	rm
File deleted	/var/log/exim4/mainlog	rm
File deleted	/var/log/runit/ssh	rm
File deleted	/var/log/installer/lsb-release	rm
File deleted	/var/log/wtmp	rm
File deleted	/var/log/apt/eipp.log.xz	rm
File deleted	/var/log/wtmp	rm
File deleted	/var/log/installer/cdebconf	rm
File deleted	/var/log/README	rm
File deleted	/var/log/fontconfig.log	rm
File deleted	/var/log/faillog	rm
File deleted	/var/log/installer/syslog	rm

Enumerates running processes
Discovers information about currently running processes on the system

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	hoodlum.arm6.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	omsqkqokmykxdddsuasuumds	707	hoodlum.arm6.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	hoodlum.arm6.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/73/stat	pkill
File opened for reading	/proc/749/cmdline	pkill
File opened for reading	/proc/283/cgroup	pkill
File opened for reading	/proc/291/cgroup	pkill
File opened for reading	/proc/647/ctty	pkill
File opened for reading	/proc/30/stat	pkill
File opened for reading	/proc/706/status	pkill
File opened for reading	/proc/747/cmdline	pkill
File opened for reading	/proc/631/stat	pkill
File opened for reading	/proc/747/ctty	pkill
File opened for reading	/proc/25/stat	pkill
File opened for reading	/proc/30/ctty	pkill
File opened for reading	/proc/329/ctty	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/329/stat	pkill
File opened for reading	/proc/143/status	pkill
File opened for reading	/proc/2/cgroup	pkill
File opened for reading	/proc/3/ctty	pkill
File opened for reading	/proc/20/ctty	pkill
File opened for reading	/proc/25/ctty	pkill
File opened for reading	/proc/765/ctty	pkill
File opened for reading	/proc/327/status	pkill
File opened for reading	/proc/665/status	pkill
File opened for reading	/proc/15/ctty	pkill
File opened for reading	/proc/46/stat	pkill
File opened for reading	/proc/tty/drivers	pkill
File opened for reading	/proc/646/stat	pkill
File opened for reading	/proc/10/cgroup	pkill
File opened for reading	/proc/358/ctty	pkill
File opened for reading	/proc/681/cgroup	pkill
File opened for reading	/proc/762/cgroup	pkill
File opened for reading	/proc/662/stat	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/203/cmdline	pkill
File opened for reading	/proc/347/stat	pkill
File opened for reading	/proc/21/cgroup	pkill
File opened for reading	/proc/700/cgroup	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/193/stat	pkill
File opened for reading	/proc/371/cmdline	pkill
File opened for reading	/proc/747/cmdline	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/347/ctty	pkill
File opened for reading	/proc/31/ctty	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/28/cgroup	pkill
File opened for reading	/proc/362/cgroup	pkill
File opened for reading	/proc/8/cgroup	pkill
File opened for reading	/proc/46/status	pkill
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/291/cgroup	pkill
File opened for reading	/proc/36/cgroup	pkill
File opened for reading	/proc/24/stat	pkill
File opened for reading	/proc/44/stat	pkill
File opened for reading	/proc/143/cgroup	pkill
File opened for reading	/proc/46/status	pkill
File opened for reading	/proc/186/cmdline	pkill
File opened for reading	/proc/15/ctty	pkill
File opened for reading	/proc/662/cgroup	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/56/cgroup	pkill
File opened for reading	/proc/706/stat	pkill
File opened for reading	/proc/11/ctty	pkill

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
757	sh
766	sh
767	service
776	sh

/tmp/hoodlum.arm6.elf
/tmp/hoodlum.arm6.elf
1⤵
- Deletes itself
- Writes DNS configuration
- Reads system routing table
- Changes its process name
- Reads system network configuration
PID:707
- /bin/sh
  sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"
  2⤵
  PID:731
- - /usr/bin/rm
    rm -rf /tmp/systemd-private-aa92aea9eb974e2f9c82a48fd0711cad-ntpsec.service-WptBAM /tmp/systemd-private-aa92aea9eb974e2f9c82a48fd0711cad-systemd-logind.service-cyJ1XH /tmp/systemd-private-aa92aea9eb974e2f9c82a48fd0711cad-systemd-timedated.service-wo3Uhd /var/backups /var/cache /var/lib /var/local /var/lock /var/log /var/mail /var/opt /var/run /var/spool /var/tmp /var/run/atd.pid /var/run/auditd.pid /var/run/console-setup /var/run/credentials /var/run/crond.pid /var/run/crond.reboot /var/run/dbus /var/run/dhclient.eth0.pid /var/run/exim4 /var/run/initctl /var/run/initramfs /var/run/lock /var/run/log /var/run/motd.dynamic /var/run/mount /var/run/network /var/run/ntpd.pid /var/run/sendsigs.omit.d /var/run/shm /var/run/sshd /var/run/sshd.pid /var/run/sudo /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/user /var/run/utmp /var/tmp/systemd-private-aa92aea9eb974e2f9c82a48fd0711cad-ntpsec.service-cW9q7C /var/tmp/systemd-private-aa92aea9eb974e2f9c82a48fd0711cad-systemd-logind.service-Y60xXq /var/tmp/systemd-private-aa92aea9eb974e2f9c82a48fd0711cad-systemd-timedated.service-u3KiUD
    3⤵
    - Deletes Audit logs
    - Deletes journal logs
    - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
    - Deletes log files
    PID:734
- /bin/sh
  sh -c "rm -rf /var/log/wtmp"
  2⤵
  PID:750
- - /usr/bin/rm
    rm -rf /var/log/wtmp
    3⤵
    - Deletes log files
    PID:751
- /bin/sh
  sh -c "rm -rf /tmp/*"
  2⤵
  PID:752
- - /usr/bin/rm
    rm -rf "/tmp/*"
    3⤵
    PID:753
- /bin/sh
  sh -c "rm -rf /bin/netstat"
  2⤵
  PID:754
- - /usr/bin/rm
    rm -rf /bin/netstat
    3⤵
    PID:756
- /bin/sh
  sh -c "iptables -F"
  2⤵
  - System Network Configuration Discovery
  PID:757
- /bin/sh
  sh -c "pkill -9 busybox"
  2⤵
  PID:758
- - /usr/bin/pkill
    pkill -9 busybox
    3⤵
    - Reads runtime system information
    PID:759
- /bin/sh
  sh -c "pkill -9 perl"
  2⤵
  PID:761
- - /usr/bin/pkill
    pkill -9 perl
    3⤵
    - Reads runtime system information
    PID:762
- /bin/sh
  sh -c "pkill -9 python"
  2⤵
  PID:764
- - /usr/bin/pkill
    pkill -9 python
    3⤵
    - Reads runtime system information
    PID:765
- /bin/sh
  sh -c "service iptables stop"
  2⤵
  - System Network Configuration Discovery
  PID:766
- - /usr/sbin/service
    service iptables stop
    3⤵
    - System Network Configuration Discovery
    PID:767
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:768
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:769
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:772
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      PID:771
- - /usr/local/sbin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:767
- - /usr/local/bin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:767
- - /usr/sbin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:767
- - /usr/bin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:767
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:776
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    - Flushes firewall rules
    PID:777
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    - Flushes firewall rules
    PID:778
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:779
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:780
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:781
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:782
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:785
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      PID:784
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:780
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:780
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:780
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:780
- /bin/sh
  sh -c "rm -rf ~/.bash_history"
  2⤵
  PID:788
- - /usr/bin/rm
    rm -rf "~/.bash_history"
    3⤵
    PID:789
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:790