d761ae38684f805fd09725a77aeb65ead2b807a023d0d7de3f8c0148d0355d69

Analysis

max time kernel
92s
max time network
143s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
22/02/2025, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hoodlum.arm6.elf
Size

139KB
MD5

6f351c4bf02ac3ad8450c60ba15fdbdc
SHA1

13551e83e841067672693fea3f1af0f905ef3d70
SHA256

d761ae38684f805fd09725a77aeb65ead2b807a023d0d7de3f8c0148d0355d69
SHA512

eb6cb8ec276a8e612dfb0e6f355aa6bbc41b6ef1fd1f3ec140a6475eb305eb3e9327b6e29ef04ec69d11e89007868d6d95a6222b3b3f9a707c8761000e3409de
SSDEEP

3072:p7dxHETIJTWhmXUI8ma3xXVuu9KrKedP5hwf254Khh6myPQaS+pg7e:pAI8ma3xX4dP5hwf2ymyPQaSGg7e

Score

7^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Deletes Audit logs 1 TTPs 1 IoCs

Deletes logs related to the Linux Audit framework.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/audit/audit.log	rm

Deletes itself 1 IoCs

pid	Process
712	hoodlum.arm6.elf

Deletes journal logs 1 TTPs 4 IoCs

Deletes systemd journal logs. Likely to evade detection.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/journal/65779e181e584f059cb9deb1099989c3	rm
File deleted	/var/log/journal/65779e181e584f059cb9deb1099989c3/system.journal	rm
File deleted	/var/log/journal/65779e181e584f059cb9deb1099989c3/[email protected]~	rm
File deleted	/var/log/journal/65779e181e584f059cb9deb1099989c3/system@02cf73c9cf814290b2aa29fdcb504f4a-00000000000003b9-000611df71c6df37.journal	rm

Flushes firewall rules 1 TTPs 6 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
778	iptables
780	systemctl
780	systemctl
780	systemctl
780	systemctl
777	iptables

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/resolv.conf	hoodlum.arm6.elf

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
722	rm

Deletes log files 1 TTPs 30 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/fontconfig.log	rm
File deleted	/var/log/apt/eipp.log.xz	rm
File deleted	/var/log/installer/lsb-release	rm
File deleted	/var/log/installer	rm
File deleted	/var/log/wtmp	rm
File deleted	/var/log/dpkg.log	rm
File deleted	/var/log/btmp	rm
File deleted	/var/log/runit	rm
File deleted	/var/log/apt	rm
File deleted	/var/log/wtmp	rm
File deleted	/var/log/installer/cdebconf/templates.dat	rm
File deleted	/var/log/installer/cdebconf	rm
File deleted	/var/log/installer/firmware-summary	rm
File deleted	/var/log/exim4	rm
File deleted	/var/log/apt/history.log	rm
File deleted	/var/log/faillog	rm
File deleted	/var/log/installer/cdebconf/questions.dat	rm
File deleted	/var/log/installer/partman	rm
File deleted	/var/log/alternatives.log	rm
File deleted	/var/log/journal	rm
File deleted	/var/log/exim4/mainlog	rm
File deleted	/var/log/runit/ssh	rm
File deleted	/var/log/installer/syslog	rm
File deleted	/var/log/audit	rm
File deleted	/var/log/README	rm
File deleted	/var/log/installer/status	rm
File deleted	/var/log/apt/term.log	rm
File deleted	/var/log/private	rm
File deleted	/var/log/lastlog	rm
File deleted	/var/log/installer/hardware-summary	rm

Enumerates running processes
Discovers information about currently running processes on the system

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	hoodlum.arm6.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	muxuduymsdpdaaqaomga	712	hoodlum.arm6.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	hoodlum.arm6.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/333/status	pkill
File opened for reading	/proc/362/stat	pkill
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/216/status	pkill
File opened for reading	/proc/331/status	pkill
File opened for reading	/proc/203/cmdline	pkill
File opened for reading	/proc/350/stat	pkill
File opened for reading	/proc/653/status	pkill
File opened for reading	/proc/362/ctty	pkill
File opened for reading	/proc/36/stat	pkill
File opened for reading	/proc/325/cmdline	pkill
File opened for reading	/proc/325/cgroup	pkill
File opened for reading	/proc/264/cmdline	pkill
File opened for reading	/proc/762/status	pkill
File opened for reading	/proc/1/cgroup	pkill
File opened for reading	/proc/747/ctty	pkill
File opened for reading	/proc/36/stat	pkill
File opened for reading	/proc/711/status	pkill
File opened for reading	/proc/4/stat	pkill
File opened for reading	/proc/21/ctty	pkill
File opened for reading	/proc/324/ctty	pkill
File opened for reading	/proc/46/status	pkill
File opened for reading	/proc/264/stat	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/203/cgroup	pkill
File opened for reading	/proc/1/stat	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/31/status	pkill
File opened for reading	/proc/221/cgroup	pkill
File opened for reading	/proc/7/ctty	pkill
File opened for reading	/proc/20/ctty	pkill
File opened for reading	/proc/22/stat	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/30/ctty	pkill
File opened for reading	/proc/639/cgroup	pkill
File opened for reading	/proc/188/cmdline	pkill
File opened for reading	/proc/349/cmdline	pkill
File opened for reading	/proc/350/stat	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/tty/drivers	pkill
File opened for reading	/proc/349/status	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/18/ctty	pkill
File opened for reading	/proc/22/ctty	pkill
File opened for reading	/proc/42/stat	pkill
File opened for reading	/proc/721/cmdline	pkill
File opened for reading	/proc/219/cgroup	pkill
File opened for reading	/proc/222/status	pkill
File opened for reading	/proc/639/cgroup	pkill
File opened for reading	/proc/324/cgroup	pkill
File opened for reading	/proc/15/stat	pkill
File opened for reading	/proc/331/cmdline	pkill
File opened for reading	/proc/12/stat	pkill
File opened for reading	/proc/14/cgroup	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/721/stat	pkill
File opened for reading	/proc/203/ctty	pkill
File opened for reading	/proc/705/ctty	pkill
File opened for reading	/proc/749/status	pkill
File opened for reading	/proc/34/stat	pkill
File opened for reading	/proc/203/cmdline	pkill
File opened for reading	/proc/220/cmdline	pkill

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
764	service
776	sh
756	sh
763	sh

/tmp/hoodlum.arm6.elf
/tmp/hoodlum.arm6.elf
1⤵
- Deletes itself
- Writes DNS configuration
- Reads system routing table
- Changes its process name
- Reads system network configuration
PID:712
- /bin/sh
  sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"
  2⤵
  PID:719
- - /usr/bin/rm
    rm -rf /tmp/systemd-private-f403c4b13b96432792c6aac4b941f5d9-ntpsec.service-IowJWF /tmp/systemd-private-f403c4b13b96432792c6aac4b941f5d9-systemd-logind.service-Cf3Hec /tmp/systemd-private-f403c4b13b96432792c6aac4b941f5d9-systemd-timedated.service-IqdXlm /var/backups /var/cache /var/lib /var/local /var/lock /var/log /var/mail /var/opt /var/run /var/spool /var/tmp /var/run/atd.pid /var/run/auditd.pid /var/run/console-setup /var/run/credentials /var/run/crond.pid /var/run/crond.reboot /var/run/dbus /var/run/dhclient.eth0.pid /var/run/exim4 /var/run/initctl /var/run/initramfs /var/run/lock /var/run/log /var/run/motd.dynamic /var/run/mount /var/run/network /var/run/ntpd.pid /var/run/sendsigs.omit.d /var/run/shm /var/run/sshd /var/run/sshd.pid /var/run/sudo /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/user /var/run/utmp /var/tmp/systemd-private-f403c4b13b96432792c6aac4b941f5d9-ntpsec.service-MgPPsa /var/tmp/systemd-private-f403c4b13b96432792c6aac4b941f5d9-systemd-logind.service-cunh4V /var/tmp/systemd-private-f403c4b13b96432792c6aac4b941f5d9-systemd-timedated.service-qbgaB8
    3⤵
    - Deletes Audit logs
    - Deletes journal logs
    - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
    - Deletes log files
    PID:722
- /bin/sh
  sh -c "rm -rf /var/log/wtmp"
  2⤵
  PID:750
- - /usr/bin/rm
    rm -rf /var/log/wtmp
    3⤵
    - Deletes log files
    PID:751
- /bin/sh
  sh -c "rm -rf /tmp/*"
  2⤵
  PID:752
- - /usr/bin/rm
    rm -rf "/tmp/*"
    3⤵
    PID:753
- /bin/sh
  sh -c "rm -rf /bin/netstat"
  2⤵
  PID:754
- - /usr/bin/rm
    rm -rf /bin/netstat
    3⤵
    PID:755
- /bin/sh
  sh -c "iptables -F"
  2⤵
  - System Network Configuration Discovery
  PID:756
- /bin/sh
  sh -c "pkill -9 busybox"
  2⤵
  PID:757
- - /usr/bin/pkill
    pkill -9 busybox
    3⤵
    - Reads runtime system information
    PID:758
- /bin/sh
  sh -c "pkill -9 perl"
  2⤵
  PID:759
- - /usr/bin/pkill
    pkill -9 perl
    3⤵
    - Reads runtime system information
    PID:760
- /bin/sh
  sh -c "pkill -9 python"
  2⤵
  PID:761
- - /usr/bin/pkill
    pkill -9 python
    3⤵
    - Reads runtime system information
    PID:762
- /bin/sh
  sh -c "service iptables stop"
  2⤵
  - System Network Configuration Discovery
  PID:763
- - /usr/sbin/service
    service iptables stop
    3⤵
    - System Network Configuration Discovery
    PID:764
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:765
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:766
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:769
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      PID:768
- - /usr/local/sbin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:764
- - /usr/local/bin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:764
- - /usr/sbin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:764
- - /usr/bin/systemctl
    systemctl stop iptables.service
    3⤵
    PID:764
- /bin/sh
  sh -c "/sbin/iptables -F; /sbin/iptables -X"
  2⤵
  - System Network Configuration Discovery
  PID:776
- - /sbin/iptables
    /sbin/iptables -F
    3⤵
    - Flushes firewall rules
    PID:777
- - /sbin/iptables
    /sbin/iptables -X
    3⤵
    - Flushes firewall rules
    PID:778
- /bin/sh
  sh -c "service firewalld stop"
  2⤵
  PID:779
- - /usr/sbin/service
    service firewalld stop
    3⤵
    PID:780
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:781
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:782
  - - /usr/bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:785
  - - /usr/bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      PID:784
- - /usr/local/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:780
- - /usr/local/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:780
- - /usr/sbin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:780
- - /usr/bin/systemctl
    systemctl stop firewalld.service
    3⤵
    - Flushes firewall rules
    PID:780
- /bin/sh
  sh -c "rm -rf ~/.bash_history"
  2⤵
  PID:788
- - /usr/bin/rm
    rm -rf "~/.bash_history"
    3⤵
    PID:789
- /bin/sh
  sh -c "history -c"
  2⤵
  PID:790