Overview

overview

10

Static

static

10

hoodlum.arm4.elf

debian-9-armhf

7

Analysis

  • max time kernel
    132s
  • max time network
    134s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240729-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    22/02/2025, 17:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    hoodlum.arm4.elf

  • Size

    135KB

  • MD5

    bae707d3b1c351126c597d6758a4cffe

  • SHA1

    96bd39a7e0b1f08c29a8c739af86a371b54e22a3

  • SHA256

    fabd6308a61a5991c5da0945256ceee26cc88b5e839e41dc02444bdafe485667

  • SHA512

    1dfe52fef9d30f628c4e7a9ab4480ad78a102bf0251f543095823023330d58def3ba7c9f372f5a195f563bebed9b8921050f23dd9a932a5b4da5142d8a2e962a

  • SSDEEP

    3072:EHHyPnuTxmxpjcVhyofAWuvm5ReFfgK4iOtQlQ+135hwP/TJo1m6QNdNpHOe:wHyBvgwEtQlQC35hwP/Ti1m6QNdLHOe

Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • Deletes Audit logs 1 TTPs 1 IoCs

    Deletes logs related to the Linux Audit framework.

    defense_evasion
  • Deletes itself 1 IoCs
  • Deletes system logs 1 TTPs 2 IoCs

    Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    defense_evasion
  • Flushes firewall rules 1 TTPs 9 IoCs

    Flushes/ disables firewall rules inside the Linux kernel.

    defense_evasion
  • Writes DNS configuration 1 TTPs 1 IoCs

    Writes data to DNS resolver config file.

  • Deletes log files 1 TTPs 29 IoCs

    Deletes log files on the system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  • Changes its process name 1 IoCs
  • Reads CPU attributes 1 TTPs 3 IoCs
    discovery
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 30 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/hoodlum.arm4.elf
    /tmp/hoodlum.arm4.elf
    1⤵
    • Deletes itself
    • Writes DNS configuration
    • Reads system routing table
    • Changes its process name
    • Reads system network configuration
    PID:639
    • /bin/sh
      sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*"
      2⤵
        PID:642
        • /bin/rm
          rm -rf /tmp/systemd-private-3f06e9d4f70b43a0af54b755c961002a-systemd-timedated.service-ozuXlS /var/backups /var/cache /var/lib /var/local /var/lock /var/log /var/mail /var/opt /var/run /var/spool /var/tmp /var/run/atd.pid /var/run/auditd.pid /var/run/console-setup /var/run/crond.pid /var/run/crond.reboot /var/run/dbus /var/run/dhclient.eth0.pid /var/run/exim4 /var/run/initctl /var/run/initramfs /var/run/lock /var/run/log /var/run/motd.dynamic /var/run/mount /var/run/network /var/run/rsyslogd.pid /var/run/sendsigs.omit.d /var/run/shm /var/run/sshd /var/run/sshd.pid /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/user /var/run/utmp /var/tmp/systemd-private-3f06e9d4f70b43a0af54b755c961002a-systemd-timedated.service-o2ucMc
          3⤵
          • Deletes Audit logs
          • Deletes system logs
          • Deletes log files
          PID:644
      • /bin/sh
        sh -c "rm -rf /var/log/wtmp"
        2⤵
          PID:661
          • /bin/rm
            rm -rf /var/log/wtmp
            3⤵
            • Deletes log files
            PID:662
        • /bin/sh
          sh -c "rm -rf /tmp/*"
          2⤵
            PID:663
            • /bin/rm
              rm -rf "/tmp/*"
              3⤵
                PID:664
            • /bin/sh
              sh -c "rm -rf /bin/netstat"
              2⤵
                PID:665
                • /bin/rm
                  rm -rf /bin/netstat
                  3⤵
                    PID:666
                • /bin/sh
                  sh -c "iptables -F"
                  2⤵
                  • System Network Configuration Discovery
                  PID:667
                  • /sbin/iptables
                    iptables -F
                    3⤵
                    • Flushes firewall rules
                    PID:668
                • /bin/sh
                  sh -c "pkill -9 busybox"
                  2⤵
                    PID:672
                    • /usr/bin/pkill
                      pkill -9 busybox
                      3⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:673
                  • /bin/sh
                    sh -c "pkill -9 perl"
                    2⤵
                      PID:674
                      • /usr/bin/pkill
                        pkill -9 perl
                        3⤵
                        • Reads CPU attributes
                        • Reads runtime system information
                        PID:675
                    • /bin/sh
                      sh -c "pkill -9 python"
                      2⤵
                        PID:676
                        • /usr/bin/pkill
                          pkill -9 python
                          3⤵
                          • Reads CPU attributes
                          • Reads runtime system information
                          PID:677
                      • /bin/sh
                        sh -c "service iptables stop"
                        2⤵
                        • System Network Configuration Discovery
                        PID:678
                        • /usr/sbin/service
                          service iptables stop
                          3⤵
                          • System Network Configuration Discovery
                          PID:679
                          • /usr/bin/basename
                            basename /usr/sbin/service
                            4⤵
                              PID:680
                            • /usr/bin/basename
                              basename /usr/sbin/service
                              4⤵
                                PID:681
                              • /bin/systemctl
                                systemctl --quiet is-active multi-user.target
                                4⤵
                                • Enumerates kernel/hardware configuration
                                • Reads runtime system information
                                PID:682
                              • /bin/systemctl
                                systemctl list-unit-files --full "--type=socket"
                                4⤵
                                • Enumerates kernel/hardware configuration
                                PID:684
                              • /bin/sed
                                sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                4⤵
                                  PID:685
                                • /bin/systemctl
                                  systemctl -p Triggers show dbus.socket
                                  4⤵
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:686
                                • /bin/systemctl
                                  systemctl -p Triggers show ssh.socket
                                  4⤵
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:687
                                • /bin/systemctl
                                  systemctl -p Triggers show syslog.socket
                                  4⤵
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:688
                                • /bin/systemctl
                                  systemctl -p Triggers show systemd-fsckd.socket
                                  4⤵
                                  • Enumerates kernel/hardware configuration
                                  PID:689
                                • /bin/systemctl
                                  systemctl -p Triggers show systemd-initctl.socket
                                  4⤵
                                  • Enumerates kernel/hardware configuration
                                  PID:690
                                • /bin/systemctl
                                  systemctl -p Triggers show systemd-journald-audit.socket
                                  4⤵
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:691
                                • /bin/systemctl
                                  systemctl -p Triggers show systemd-journald-dev-log.socket
                                  4⤵
                                  • Enumerates kernel/hardware configuration
                                  PID:692
                                • /bin/systemctl
                                  systemctl -p Triggers show systemd-journald.socket
                                  4⤵
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:693
                                • /bin/systemctl
                                  systemctl -p Triggers show systemd-networkd.socket
                                  4⤵
                                  • Enumerates kernel/hardware configuration
                                  PID:694
                                • /bin/systemctl
                                  systemctl -p Triggers show systemd-rfkill.socket
                                  4⤵
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:695
                                • /bin/systemctl
                                  systemctl -p Triggers show systemd-udevd-control.socket
                                  4⤵
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:696
                                • /bin/systemctl
                                  systemctl -p Triggers show systemd-udevd-kernel.socket
                                  4⤵
                                  • Enumerates kernel/hardware configuration
                                  PID:697
                              • /usr/local/sbin/systemctl
                                systemctl stop iptables.service
                                3⤵
                                  PID:679
                                • /usr/local/bin/systemctl
                                  systemctl stop iptables.service
                                  3⤵
                                    PID:679
                                  • /usr/sbin/systemctl
                                    systemctl stop iptables.service
                                    3⤵
                                      PID:679
                                    • /usr/bin/systemctl
                                      systemctl stop iptables.service
                                      3⤵
                                        PID:679
                                      • /sbin/systemctl
                                        systemctl stop iptables.service
                                        3⤵
                                          PID:679
                                        • /bin/systemctl
                                          systemctl stop iptables.service
                                          3⤵
                                          • Enumerates kernel/hardware configuration
                                          PID:679
                                      • /bin/sh
                                        sh -c "/sbin/iptables -F; /sbin/iptables -X"
                                        2⤵
                                        • System Network Configuration Discovery
                                        PID:698
                                        • /sbin/iptables
                                          /sbin/iptables -F
                                          3⤵
                                          • Flushes firewall rules
                                          PID:699
                                        • /sbin/iptables
                                          /sbin/iptables -X
                                          3⤵
                                          • Flushes firewall rules
                                          PID:700
                                      • /bin/sh
                                        sh -c "service firewalld stop"
                                        2⤵
                                          PID:701
                                          • /usr/sbin/service
                                            service firewalld stop
                                            3⤵
                                              PID:702
                                              • /usr/bin/basename
                                                basename /usr/sbin/service
                                                4⤵
                                                  PID:703
                                                • /usr/bin/basename
                                                  basename /usr/sbin/service
                                                  4⤵
                                                    PID:704
                                                  • /bin/systemctl
                                                    systemctl --quiet is-active multi-user.target
                                                    4⤵
                                                    • Enumerates kernel/hardware configuration
                                                    PID:705
                                                  • /bin/sed
                                                    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                                    4⤵
                                                      PID:708
                                                    • /bin/systemctl
                                                      systemctl list-unit-files --full "--type=socket"
                                                      4⤵
                                                      • Enumerates kernel/hardware configuration
                                                      • Reads runtime system information
                                                      PID:707
                                                    • /bin/systemctl
                                                      systemctl -p Triggers show dbus.socket
                                                      4⤵
                                                      • Enumerates kernel/hardware configuration
                                                      PID:709
                                                    • /bin/systemctl
                                                      systemctl -p Triggers show ssh.socket
                                                      4⤵
                                                      • Enumerates kernel/hardware configuration
                                                      PID:710
                                                    • /bin/systemctl
                                                      systemctl -p Triggers show syslog.socket
                                                      4⤵
                                                      • Enumerates kernel/hardware configuration
                                                      PID:711
                                                    • /bin/systemctl
                                                      systemctl -p Triggers show systemd-fsckd.socket
                                                      4⤵
                                                      • Enumerates kernel/hardware configuration
                                                      • Reads runtime system information
                                                      PID:712
                                                    • /bin/systemctl
                                                      systemctl -p Triggers show systemd-initctl.socket
                                                      4⤵
                                                      • Enumerates kernel/hardware configuration
                                                      PID:713
                                                    • /bin/systemctl
                                                      systemctl -p Triggers show systemd-journald-audit.socket
                                                      4⤵
                                                      • Enumerates kernel/hardware configuration
                                                      • Reads runtime system information
                                                      PID:714
                                                    • /bin/systemctl
                                                      systemctl -p Triggers show systemd-journald-dev-log.socket
                                                      4⤵
                                                      • Enumerates kernel/hardware configuration
                                                      • Reads runtime system information
                                                      PID:715
                                                    • /bin/systemctl
                                                      systemctl -p Triggers show systemd-journald.socket
                                                      4⤵
                                                      • Enumerates kernel/hardware configuration
                                                      PID:719
                                                    • /bin/systemctl
                                                      systemctl -p Triggers show systemd-networkd.socket
                                                      4⤵
                                                      • Enumerates kernel/hardware configuration
                                                      PID:722
                                                    • /bin/systemctl
                                                      systemctl -p Triggers show systemd-rfkill.socket
                                                      4⤵
                                                      • Enumerates kernel/hardware configuration
                                                      PID:723
                                                    • /bin/systemctl
                                                      systemctl -p Triggers show systemd-udevd-control.socket
                                                      4⤵
                                                      • Enumerates kernel/hardware configuration
                                                      • Reads runtime system information
                                                      PID:724
                                                    • /bin/systemctl
                                                      systemctl -p Triggers show systemd-udevd-kernel.socket
                                                      4⤵
                                                      • Enumerates kernel/hardware configuration
                                                      PID:725
                                                  • /usr/local/sbin/systemctl
                                                    systemctl stop firewalld.service
                                                    3⤵
                                                    • Flushes firewall rules
                                                    PID:702
                                                  • /usr/local/bin/systemctl
                                                    systemctl stop firewalld.service
                                                    3⤵
                                                    • Flushes firewall rules
                                                    PID:702
                                                  • /usr/sbin/systemctl
                                                    systemctl stop firewalld.service
                                                    3⤵
                                                    • Flushes firewall rules
                                                    PID:702
                                                  • /usr/bin/systemctl
                                                    systemctl stop firewalld.service
                                                    3⤵
                                                    • Flushes firewall rules
                                                    PID:702
                                                  • /sbin/systemctl
                                                    systemctl stop firewalld.service
                                                    3⤵
                                                    • Flushes firewall rules
                                                    PID:702
                                                  • /bin/systemctl
                                                    systemctl stop firewalld.service
                                                    3⤵
                                                    • Flushes firewall rules
                                                    • Enumerates kernel/hardware configuration
                                                    • Reads runtime system information
                                                    PID:702
                                                • /bin/sh
                                                  sh -c "rm -rf ~/.bash_history"
                                                  2⤵
                                                    PID:726
                                                    • /bin/rm
                                                      rm -rf "~/.bash_history"
                                                      3⤵
                                                        PID:727
                                                    • /bin/sh
                                                      sh -c "history -c"
                                                      2⤵
                                                        PID:728

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads