Analysis
-
max time kernel
150s -
max time network
156s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
28/03/2025, 03:08
Static task
static1
Behavioral task
behavioral1
Sample
arm6.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
8 signatures
150 seconds
General
-
Target
arm6.elf
-
Size
116KB
-
MD5
77f104113a436d31bd2008db5e335f57
-
SHA1
8db8ca3c9944f2daed4ca08516f634b85f21ed2a
-
SHA256
564059ffc1215f072196d19674d6cebdf7496abe17a6ff56fc540cd4d2f67431
-
SHA512
0e6657613caa3ea9dc6bce89c015a2d98b7bc64c60f0fd93c8de9a55894d0357c543de68183d014d20f46c9dd364f88a487cd505fadb62163889382b3df1cf1e
-
SSDEEP
3072:UwKjJ2vr1SVt5hGG/hoH0QkITZgL0ZuBRYWaznON1jYnr:UZJ2vr1SVt5hG+42IC6IRYBzq1I
Score
9/10
Malware Config
Signatures
-
Contacts a large (25720) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Renames itself 1 IoCs
pid Process 703 arm6.elf -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 22 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/718/maps arm6.elf File opened for reading /proc/721/maps arm6.elf File opened for reading /proc/723/maps arm6.elf File opened for reading /proc/725/maps arm6.elf File opened for reading /proc/726/maps arm6.elf File opened for reading /proc/714/maps arm6.elf File opened for reading /proc/716/maps arm6.elf File opened for reading /proc/717/maps arm6.elf File opened for reading /proc/724/maps arm6.elf File opened for reading /proc/1/maps arm6.elf File opened for reading /proc/636/maps arm6.elf File opened for reading /proc/715/maps arm6.elf File opened for reading /proc/719/maps arm6.elf File opened for reading /proc/720/maps arm6.elf File opened for reading /proc/722/maps arm6.elf File opened for reading /proc/728/maps arm6.elf File opened for reading /proc/733/maps arm6.elf File opened for reading /proc/341/maps arm6.elf File opened for reading /proc/727/maps arm6.elf File opened for reading /proc/734/maps arm6.elf File opened for reading /proc/345/maps arm6.elf File opened for reading /proc/637/maps arm6.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself dvrEncoder 703 arm6.elf -
description ioc Process File opened for reading /proc/31/cmdline arm6.elf File opened for reading /proc/143/cmdline arm6.elf File opened for reading /proc/221/cmdline arm6.elf File opened for reading /proc/310/cmdline arm6.elf File opened for reading /proc/683/cmdline arm6.elf File opened for reading /proc/702/cmdline arm6.elf File opened for reading /proc/637/fd arm6.elf File opened for reading /proc/10/cmdline arm6.elf File opened for reading /proc/28/cmdline arm6.elf File opened for reading /proc/187/cmdline arm6.elf File opened for reading /proc/25/cmdline arm6.elf File opened for reading /proc/45/cmdline arm6.elf File opened for reading /proc/717/cmdline arm6.elf File opened for reading /proc/2/cmdline arm6.elf File opened for reading /proc/26/cmdline arm6.elf File opened for reading /proc/310/fd arm6.elf File opened for reading /proc/34/cmdline arm6.elf File opened for reading /proc/637/cmdline arm6.elf File opened for reading /proc/345/fd arm6.elf File opened for reading /proc/726/fd arm6.elf File opened for reading /proc/8/cmdline arm6.elf File opened for reading /proc/316/cmdline arm6.elf File opened for reading /proc/680/cmdline arm6.elf File opened for reading /proc/703/fd arm6.elf File opened for reading /proc/self/maps arm6.elf File opened for reading /proc/14/cmdline arm6.elf File opened for reading /proc/317/cmdline arm6.elf File opened for reading /proc/318/fd arm6.elf File opened for reading /proc/341/fd arm6.elf File opened for reading /proc/724/cmdline arm6.elf File opened for reading /proc/734/cmdline arm6.elf File opened for reading /proc/5/cmdline arm6.elf File opened for reading /proc/52/cmdline arm6.elf File opened for reading /proc/341/cmdline arm6.elf File opened for reading /proc/485/cmdline arm6.elf File opened for reading /proc/492/cmdline arm6.elf File opened for reading /proc/679/cmdline arm6.elf File opened for reading /proc/318/cmdline arm6.elf File opened for reading /proc/316/fd arm6.elf File opened for reading /proc/725/fd arm6.elf File opened for reading /proc/17/cmdline arm6.elf File opened for reading /proc/57/cmdline arm6.elf File opened for reading /proc/703/cmdline arm6.elf File opened for reading /proc/1/fd arm6.elf File opened for reading /proc/13/cmdline arm6.elf File opened for reading /proc/38/cmdline arm6.elf File opened for reading /proc/492/fd arm6.elf File opened for reading /proc/680/fd arm6.elf File opened for reading /proc/718/cmdline arm6.elf File opened for reading /proc/15/cmdline arm6.elf File opened for reading /proc/46/cmdline arm6.elf File opened for reading /proc/706/cmdline arm6.elf File opened for reading /proc/339/fd arm6.elf File opened for reading /proc/722/cmdline arm6.elf File opened for reading /proc/696/cmdline arm6.elf File opened for reading /proc/706/fd arm6.elf File opened for reading /proc/9/cmdline arm6.elf File opened for reading /proc/723/cmdline arm6.elf File opened for reading /proc/485/fd arm6.elf File opened for reading /proc/727/cmdline arm6.elf File opened for reading /proc/728/fd arm6.elf File opened for reading /proc/7/cmdline arm6.elf File opened for reading /proc/35/cmdline arm6.elf File opened for reading /proc/679/fd arm6.elf