Analysis
-
max time kernel
150s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
28/03/2025, 03:28
Static task
static1
Behavioral task
behavioral1
Sample
arm.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
8 signatures
150 seconds
General
-
Target
arm.elf
-
Size
97KB
-
MD5
15c77c0d08d225e22e633caafa63a658
-
SHA1
793412d664982cf43a6bfedcee89cb6b018fbaa0
-
SHA256
aa80d4d64a986fb84c73b7d910c4d9642a2dc54f091fb8d9427fd5385ae39338
-
SHA512
5f81cafc172f3caca6d7e0c2d988a18b163de7a92b40ee7ec9d00cabad25b0c15aa4ac040d83ca8948b53800f8989e50e0f96df9ab1f9550d894e2830a03ba6f
-
SSDEEP
3072:xw+ZwS9bfZRdzWoORyGkaa2jqS6aOjvHNvAn9bFNSwtwUitnl:xnZH9BRdzWNy2tO5vANSywUir
Score
9/10
Malware Config
Signatures
-
Contacts a large (23672) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Renames itself 1 IoCs
pid Process 651 arm.elf -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.222.222 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 40 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/691/maps arm.elf File opened for reading /proc/692/maps arm.elf File opened for reading /proc/696/maps arm.elf File opened for reading /proc/665/maps arm.elf File opened for reading /proc/668/maps arm.elf File opened for reading /proc/677/maps arm.elf File opened for reading /proc/679/maps arm.elf File opened for reading /proc/290/maps arm.elf File opened for reading /proc/451/maps arm.elf File opened for reading /proc/450/maps arm.elf File opened for reading /proc/666/maps arm.elf File opened for reading /proc/675/maps arm.elf File opened for reading /proc/688/maps arm.elf File opened for reading /proc/1/maps arm.elf File opened for reading /proc/676/maps arm.elf File opened for reading /proc/680/maps arm.elf File opened for reading /proc/693/maps arm.elf File opened for reading /proc/695/maps arm.elf File opened for reading /proc/661/maps arm.elf File opened for reading /proc/664/maps arm.elf File opened for reading /proc/694/maps arm.elf File opened for reading /proc/662/maps arm.elf File opened for reading /proc/672/maps arm.elf File opened for reading /proc/683/maps arm.elf File opened for reading /proc/684/maps arm.elf File opened for reading /proc/686/maps arm.elf File opened for reading /proc/690/maps arm.elf File opened for reading /proc/293/maps arm.elf File opened for reading /proc/667/maps arm.elf File opened for reading /proc/669/maps arm.elf File opened for reading /proc/670/maps arm.elf File opened for reading /proc/671/maps arm.elf File opened for reading /proc/678/maps arm.elf File opened for reading /proc/681/maps arm.elf File opened for reading /proc/682/maps arm.elf File opened for reading /proc/660/maps arm.elf File opened for reading /proc/663/maps arm.elf File opened for reading /proc/685/maps arm.elf File opened for reading /proc/687/maps arm.elf File opened for reading /proc/689/maps arm.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself ptzcontrol 651 arm.elf -
description ioc Process File opened for reading /proc/22/cmdline arm.elf File opened for reading /proc/1/cmdline arm.elf File opened for reading /proc/661/cmdline arm.elf File opened for reading /proc/667/cmdline arm.elf File opened for reading /proc/670/cmdline arm.elf File opened for reading /proc/678/cmdline arm.elf File opened for reading /proc/679/cmdline arm.elf File opened for reading /proc/20/cmdline arm.elf File opened for reading /proc/685/cmdline arm.elf File opened for reading /proc/686/cmdline arm.elf File opened for reading /proc/692/fd arm.elf File opened for reading /proc/260/cmdline arm.elf File opened for reading /proc/689/fd arm.elf File opened for reading /proc/25/cmdline arm.elf File opened for reading /proc/28/cmdline arm.elf File opened for reading /proc/643/cmdline arm.elf File opened for reading /proc/293/fd arm.elf File opened for reading /proc/669/cmdline arm.elf File opened for reading /proc/672/cmdline arm.elf File opened for reading /proc/6/cmdline arm.elf File opened for reading /proc/106/cmdline arm.elf File opened for reading /proc/450/cmdline arm.elf File opened for reading /proc/638/fd arm.elf File opened for reading /proc/675/cmdline arm.elf File opened for reading /proc/684/fd arm.elf File opened for reading /proc/688/cmdline arm.elf File opened for reading /proc/694/fd arm.elf File opened for reading /proc/12/cmdline arm.elf File opened for reading /proc/43/cmdline arm.elf File opened for reading /proc/265/cmdline arm.elf File opened for reading /proc/656/cmdline arm.elf File opened for reading /proc/695/cmdline arm.elf File opened for reading /proc/8/cmdline arm.elf File opened for reading /proc/74/cmdline arm.elf File opened for reading /proc/300/fd arm.elf File opened for reading /proc/680/fd arm.elf File opened for reading /proc/27/cmdline arm.elf File opened for reading /proc/131/fd arm.elf File opened for reading /proc/23/cmdline arm.elf File opened for reading /proc/10/cmdline arm.elf File opened for reading /proc/16/cmdline arm.elf File opened for reading /proc/651/cmdline arm.elf File opened for reading /proc/264/fd arm.elf File opened for reading /proc/676/cmdline arm.elf File opened for reading /proc/290/cmdline arm.elf File opened for reading /proc/167/fd arm.elf File opened for reading /proc/200/fd arm.elf File opened for reading /proc/687/fd arm.elf File opened for reading /proc/689/cmdline arm.elf File opened for reading /proc/2/cmdline arm.elf File opened for reading /proc/19/cmdline arm.elf File opened for reading /proc/26/cmdline arm.elf File opened for reading /proc/42/cmdline arm.elf File opened for reading /proc/95/cmdline arm.elf File opened for reading /proc/104/cmdline arm.elf File opened for reading /proc/683/cmdline arm.elf File opened for reading /proc/692/cmdline arm.elf File opened for reading /proc/646/cmdline arm.elf File opened for reading /proc/41/cmdline arm.elf File opened for reading /proc/265/fd arm.elf File opened for reading /proc/277/fd arm.elf File opened for reading /proc/671/fd arm.elf File opened for reading /proc/676/fd arm.elf File opened for reading /proc/691/fd arm.elf