Analysis
-
max time kernel
126s -
max time network
160s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
28/03/2025, 03:11
Static task
static1
Behavioral task
behavioral1
Sample
arm6.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
8 signatures
150 seconds
General
-
Target
arm6.elf
-
Size
116KB
-
MD5
77f104113a436d31bd2008db5e335f57
-
SHA1
8db8ca3c9944f2daed4ca08516f634b85f21ed2a
-
SHA256
564059ffc1215f072196d19674d6cebdf7496abe17a6ff56fc540cd4d2f67431
-
SHA512
0e6657613caa3ea9dc6bce89c015a2d98b7bc64c60f0fd93c8de9a55894d0357c543de68183d014d20f46c9dd364f88a487cd505fadb62163889382b3df1cf1e
-
SSDEEP
3072:UwKjJ2vr1SVt5hGG/hoH0QkITZgL0ZuBRYWaznON1jYnr:UZJ2vr1SVt5hG+42IC6IRYBzq1I
Score
9/10
Malware Config
Signatures
-
Contacts a large (31522) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Renames itself 1 IoCs
pid Process 651 arm6.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/690/maps arm6.elf File opened for reading /proc/691/maps arm6.elf File opened for reading /proc/724/maps arm6.elf File opened for reading /proc/739/maps arm6.elf File opened for reading /proc/305/maps arm6.elf File opened for reading /proc/677/maps arm6.elf File opened for reading /proc/678/maps arm6.elf File opened for reading /proc/682/maps arm6.elf File opened for reading /proc/715/maps arm6.elf File opened for reading /proc/1/maps arm6.elf File opened for reading /proc/680/maps arm6.elf File opened for reading /proc/717/maps arm6.elf File opened for reading /proc/726/maps arm6.elf File opened for reading /proc/734/maps arm6.elf File opened for reading /proc/736/maps arm6.elf File opened for reading /proc/684/maps arm6.elf File opened for reading /proc/698/maps arm6.elf File opened for reading /proc/705/maps arm6.elf File opened for reading /proc/303/maps arm6.elf File opened for reading /proc/676/maps arm6.elf File opened for reading /proc/711/maps arm6.elf File opened for reading /proc/731/maps arm6.elf File opened for reading /proc/696/maps arm6.elf File opened for reading /proc/699/maps arm6.elf File opened for reading /proc/704/maps arm6.elf File opened for reading /proc/706/maps arm6.elf File opened for reading /proc/732/maps arm6.elf File opened for reading /proc/735/maps arm6.elf File opened for reading /proc/738/maps arm6.elf File opened for reading /proc/675/maps arm6.elf File opened for reading /proc/689/maps arm6.elf File opened for reading /proc/708/maps arm6.elf File opened for reading /proc/713/maps arm6.elf File opened for reading /proc/686/maps arm6.elf File opened for reading /proc/700/maps arm6.elf File opened for reading /proc/702/maps arm6.elf File opened for reading /proc/716/maps arm6.elf File opened for reading /proc/718/maps arm6.elf File opened for reading /proc/719/maps arm6.elf File opened for reading /proc/687/maps arm6.elf File opened for reading /proc/703/maps arm6.elf File opened for reading /proc/737/maps arm6.elf File opened for reading /proc/663/maps arm6.elf File opened for reading /proc/681/maps arm6.elf File opened for reading /proc/722/maps arm6.elf File opened for reading /proc/729/maps arm6.elf File opened for reading /proc/667/maps arm6.elf File opened for reading /proc/694/maps arm6.elf File opened for reading /proc/728/maps arm6.elf File opened for reading /proc/599/maps arm6.elf File opened for reading /proc/666/maps arm6.elf File opened for reading /proc/692/maps arm6.elf File opened for reading /proc/693/maps arm6.elf File opened for reading /proc/695/maps arm6.elf File opened for reading /proc/723/maps arm6.elf File opened for reading /proc/712/maps arm6.elf File opened for reading /proc/714/maps arm6.elf File opened for reading /proc/669/maps arm6.elf File opened for reading /proc/674/maps arm6.elf File opened for reading /proc/679/maps arm6.elf File opened for reading /proc/685/maps arm6.elf File opened for reading /proc/707/maps arm6.elf File opened for reading /proc/721/maps arm6.elf File opened for reading /proc/668/maps arm6.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself dvrEncoder 651 arm6.elf -
description ioc Process File opened for reading /proc/683/fd arm6.elf File opened for reading /proc/730/fd arm6.elf File opened for reading /proc/6/cmdline arm6.elf File opened for reading /proc/14/cmdline arm6.elf File opened for reading /proc/712/cmdline arm6.elf File opened for reading /proc/25/cmdline arm6.elf File opened for reading /proc/215/cmdline arm6.elf File opened for reading /proc/643/cmdline arm6.elf File opened for reading /proc/646/cmdline arm6.elf File opened for reading /proc/594/fd arm6.elf File opened for reading /proc/691/cmdline arm6.elf File opened for reading /proc/142/cmdline arm6.elf File opened for reading /proc/726/fd arm6.elf File opened for reading /proc/729/cmdline arm6.elf File opened for reading /proc/667/cmdline arm6.elf File opened for reading /proc/21/cmdline arm6.elf File opened for reading /proc/731/cmdline arm6.elf File opened for reading /proc/739/cmdline arm6.elf File opened for reading /proc/688/fd arm6.elf File opened for reading /proc/693/fd arm6.elf File opened for reading /proc/731/fd arm6.elf File opened for reading /proc/738/fd arm6.elf File opened for reading /proc/740/cmdline arm6.elf File opened for reading /proc/642/cmdline arm6.elf File opened for reading /proc/43/cmdline arm6.elf File opened for reading /proc/108/cmdline arm6.elf File opened for reading /proc/692/cmdline arm6.elf File opened for reading /proc/682/cmdline arm6.elf File opened for reading /proc/711/cmdline arm6.elf File opened for reading /proc/23/cmdline arm6.elf File opened for reading /proc/648/cmdline arm6.elf File opened for reading /proc/659/cmdline arm6.elf File opened for reading /proc/674/cmdline arm6.elf File opened for reading /proc/680/cmdline arm6.elf File opened for reading /proc/705/cmdline arm6.elf File opened for reading /proc/718/cmdline arm6.elf File opened for reading /proc/719/fd arm6.elf File opened for reading /proc/268/cmdline arm6.elf File opened for reading /proc/303/fd arm6.elf File opened for reading /proc/592/fd arm6.elf File opened for reading /proc/654/cmdline arm6.elf File opened for reading /proc/702/fd arm6.elf File opened for reading /proc/730/cmdline arm6.elf File opened for reading /proc/650/cmdline arm6.elf File opened for reading /proc/651/cmdline arm6.elf File opened for reading /proc/653/cmdline arm6.elf File opened for reading /proc/672/cmdline arm6.elf File opened for reading /proc/714/cmdline arm6.elf File opened for reading /proc/721/cmdline arm6.elf File opened for reading /proc/727/cmdline arm6.elf File opened for reading /proc/677/cmdline arm6.elf File opened for reading /proc/682/fd arm6.elf File opened for reading /proc/739/fd arm6.elf File opened for reading /proc/147/cmdline arm6.elf File opened for reading /proc/652/fd arm6.elf File opened for reading /proc/695/cmdline arm6.elf File opened for reading /proc/736/fd arm6.elf File opened for reading /proc/12/cmdline arm6.elf File opened for reading /proc/659/fd arm6.elf File opened for reading /proc/720/fd arm6.elf File opened for reading /proc/138/cmdline arm6.elf File opened for reading /proc/713/fd arm6.elf File opened for reading /proc/642/fd arm6.elf File opened for reading /proc/669/cmdline arm6.elf