Analysis
-
max time kernel
45s -
max time network
158s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
10/03/2025, 01:42
Behavioral task
behavioral1
Sample
nklarm7.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
8 signatures
150 seconds
General
-
Target
nklarm7.elf
-
Size
73KB
-
MD5
862793c87c5bc7664ee11d9ef2122a51
-
SHA1
1640fe8b76cb1d116aefa393ff64a532561d497a
-
SHA256
fd3d0b264db42129b267ec3b01a2f2a5414668ea82a17b47d621b15bc9282011
-
SHA512
ec7d0a59cc84412370dd952c74f56cbec786037ca36faae9d0cad60637b1943f7a18c51ffc51acc25581883fe67f127513bd509c83fbff2341bf545fb5f06f00
-
SSDEEP
1536:Npngq7mByGw9K09oABAKgddL/4/eLJX9woDVoK/M9J9lcki/H+ArX:EomBC9KABA9d+/eLR9woDVoK/fxH+u
Score
9/10
Malware Config
Signatures
-
Contacts a large (163677) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nklarm7.elf File opened for modification /dev/misc/watchdog nklarm7.elf -
Renames itself 1 IoCs
pid Process 649 nklarm7.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 81.169.136.222 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself nklarm7.elf 649 nklarm7.elf -
description ioc Process File opened for reading /proc/280/comm nklarm7.elf File opened for reading /proc/646/comm nklarm7.elf File opened for reading /proc/1/comm nklarm7.elf File opened for reading /proc/2/comm nklarm7.elf File opened for reading /proc/13/comm nklarm7.elf File opened for reading /proc/217/comm nklarm7.elf File opened for reading /proc/411/comm nklarm7.elf File opened for reading /proc/642/comm nklarm7.elf File opened for reading /proc/648/comm nklarm7.elf File opened for reading /proc/649/comm nklarm7.elf File opened for reading /proc/29/comm nklarm7.elf File opened for reading /proc/105/comm nklarm7.elf File opened for reading /proc/277/comm nklarm7.elf File opened for reading /proc/644/comm nklarm7.elf File opened for reading /proc/24/comm nklarm7.elf File opened for reading /proc/28/comm nklarm7.elf File opened for reading /proc/42/comm nklarm7.elf File opened for reading /proc/75/comm nklarm7.elf File opened for reading /proc/147/comm nklarm7.elf File opened for reading /proc/300/comm nklarm7.elf File opened for reading /proc/602/comm nklarm7.elf File opened for reading /proc/309/comm nklarm7.elf File opened for reading /proc/314/comm nklarm7.elf File opened for reading /proc/460/comm nklarm7.elf File opened for reading /proc/152/comm nklarm7.elf File opened for reading /proc/275/comm nklarm7.elf File opened for reading /proc/3/comm nklarm7.elf File opened for reading /proc/6/comm nklarm7.elf File opened for reading /proc/9/comm nklarm7.elf File opened for reading /proc/15/comm nklarm7.elf File opened for reading /proc/23/comm nklarm7.elf File opened for reading /proc/278/comm nklarm7.elf File opened for reading /proc/11/comm nklarm7.elf File opened for reading /proc/17/comm nklarm7.elf File opened for reading /proc/22/comm nklarm7.elf File opened for reading /proc/26/comm nklarm7.elf File opened for reading /proc/43/comm nklarm7.elf File opened for reading /proc/7/comm nklarm7.elf File opened for reading /proc/20/comm nklarm7.elf File opened for reading /proc/140/comm nklarm7.elf File opened for reading /proc/12/comm nklarm7.elf File opened for reading /proc/138/comm nklarm7.elf File opened for reading /proc/25/comm nklarm7.elf File opened for reading /proc/108/comm nklarm7.elf File opened for reading /proc/8/comm nklarm7.elf File opened for reading /proc/27/comm nklarm7.elf File opened for reading /proc/150/comm nklarm7.elf File opened for reading /proc/165/comm nklarm7.elf File opened for reading /proc/4/comm nklarm7.elf File opened for reading /proc/14/comm nklarm7.elf File opened for reading /proc/18/comm nklarm7.elf File opened for reading /proc/269/comm nklarm7.elf File opened for reading /proc/19/comm nklarm7.elf File opened for reading /proc/97/comm nklarm7.elf File opened for reading /proc/267/comm nklarm7.elf File opened for reading /proc/10/comm nklarm7.elf File opened for reading /proc/107/comm nklarm7.elf File opened for reading /proc/647/comm nklarm7.elf File opened for reading /proc/16/comm nklarm7.elf File opened for reading /proc/21/comm nklarm7.elf File opened for reading /proc/301/comm nklarm7.elf File opened for reading /proc/415/comm nklarm7.elf File opened for reading /proc/461/comm nklarm7.elf File opened for reading /proc/635/comm nklarm7.elf