Analysis
-
max time kernel
149s -
max time network
160s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
-
submitted
09/03/2025, 11:12
General
-
Target
apep.arm.elf
-
Size
30KB
-
MD5
38a27933778feb9672d2d88b65c28081
-
SHA1
595ed27399602fb0c0e1a2380b018226810c66f2
-
SHA256
e9864229fb4d25e82f8c13f6fb6bf8f5caa8dfb5071df0e440733b890506c395
-
SHA512
1187852ceb9ba585dfbf4e6ccefa6a4a3e6159586ce4e3100b71a9d08f51bfa58a09d391951a841a089e63f11c3dd3521dd312e28c5b7ec3596f683216cca03f
-
SSDEEP
768:N2aICfmJL5lrmxlLU0NQjli5fjdHwpTdPASP1sjq993U5:N2kfMFcxW0NQAhhHwpT7P1sjq96
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
APEP
Signatures
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Contacts a large (212279) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/apep.arm.elf/tmp/apep.arm.elf1⤵
- Changes its process name
- Reads runtime system information
- Writes file to tmp directory