Analysis
-
max time kernel
103s -
max time network
160s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
-
submitted
08/03/2025, 11:07
General
-
Target
arm.elf
-
Size
70KB
-
MD5
eca11f7fc0d09d8cd1feb833c756634d
-
SHA1
1f1438adccb3a41c1581d3ce4b5f2b3190c63aba
-
SHA256
e9d51bfc92bf3446c86edbddac88b7b6531a69fcbdaefab6dda7dc8e77f107c6
-
SHA512
20cc5e1bbee7135227bd1c42fb6aea4bfd269f55e5493d0ef22fd60513c86b7b197a4696abfc678fa4296ef597d3893a55f9a0138edc6f4aaa145dd3b136edc0
-
SSDEEP
1536:sWPKw0DX+CaF8wl82EFyFLJwq0E4lFDTFUI070R3tvH:sWzGX+n+2SiinPBUxIvH
Malware Config
Signatures
-
Contacts a large (85246) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Reads process memory 1 TTPs 24 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/arm.elf/tmp/arm.elf1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads process memory
- Changes its process name
- Reads system network configuration