Analysis
-
max time kernel
149s -
max time network
162s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
28/03/2025, 03:13
Static task
static1
Behavioral task
behavioral1
Sample
arm5.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
8 signatures
150 seconds
General
-
Target
arm5.elf
-
Size
116KB
-
MD5
55338c8a59dc346ebd80903e0a4b9828
-
SHA1
bfcac0fd6dfa159514e322315b79e69c9745d9a2
-
SHA256
3f1f0505618e509612025e0c69cde58a46d16cd48e612ab668c824ff50fae932
-
SHA512
9c641e9d0bb585b3e55fe1296211f8267e6552f72006d3a1c2997b9bdec39a78f961c2c88802b2606a58d33313ab52b754e78cb8c7b481620448f87f1df618b9
-
SSDEEP
3072:iwKjJ2vr1SVt5hGG/hoH0QkITZgL0ZuBRYWaznON1jYnr:iZJ2vr1SVt5hG+42IC6IRYBzq1I
Score
9/10
Malware Config
Signatures
-
Contacts a large (28127) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Renames itself 1 IoCs
pid Process 712 arm5.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 14 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/728/maps arm5.elf File opened for reading /proc/729/maps arm5.elf File opened for reading /proc/730/maps arm5.elf File opened for reading /proc/731/maps arm5.elf File opened for reading /proc/1/maps arm5.elf File opened for reading /proc/351/maps arm5.elf File opened for reading /proc/658/maps arm5.elf File opened for reading /proc/732/maps arm5.elf File opened for reading /proc/733/maps arm5.elf File opened for reading /proc/734/maps arm5.elf File opened for reading /proc/355/maps arm5.elf File opened for reading /proc/657/maps arm5.elf File opened for reading /proc/724/maps arm5.elf File opened for reading /proc/725/maps arm5.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself ptzcontrol 712 arm5.elf -
description ioc Process File opened for reading /proc/195/cmdline arm5.elf File opened for reading /proc/187/fd arm5.elf File opened for reading /proc/705/fd arm5.elf File opened for reading /proc/13/cmdline arm5.elf File opened for reading /proc/3/cmdline arm5.elf File opened for reading /proc/338/cmdline arm5.elf File opened for reading /proc/725/cmdline arm5.elf File opened for reading /proc/733/fd arm5.elf File opened for reading /proc/714/fd arm5.elf File opened for reading /proc/45/cmdline arm5.elf File opened for reading /proc/1/cmdline arm5.elf File opened for reading /proc/19/cmdline arm5.elf File opened for reading /proc/23/cmdline arm5.elf File opened for reading /proc/30/cmdline arm5.elf File opened for reading /proc/143/cmdline arm5.elf File opened for reading /proc/705/cmdline arm5.elf File opened for reading /proc/351/fd arm5.elf File opened for reading /proc/712/fd arm5.elf File opened for reading /proc/6/cmdline arm5.elf File opened for reading /proc/18/cmdline arm5.elf File opened for reading /proc/28/cmdline arm5.elf File opened for reading /proc/42/cmdline arm5.elf File opened for reading /proc/44/cmdline arm5.elf File opened for reading /proc/703/cmdline arm5.elf File opened for reading /proc/325/fd arm5.elf File opened for reading /proc/326/fd arm5.elf File opened for reading /proc/683/cmdline arm5.elf File opened for reading /proc/715/cmdline arm5.elf File opened for reading /proc/274/fd arm5.elf File opened for reading /proc/642/fd arm5.elf File opened for reading /proc/733/cmdline arm5.elf File opened for reading /proc/25/cmdline arm5.elf File opened for reading /proc/12/cmdline arm5.elf File opened for reading /proc/10/cmdline arm5.elf File opened for reading /proc/11/cmdline arm5.elf File opened for reading /proc/73/cmdline arm5.elf File opened for reading /proc/200/cmdline arm5.elf File opened for reading /proc/274/cmdline arm5.elf File opened for reading /proc/682/cmdline arm5.elf File opened for reading /proc/14/cmdline arm5.elf File opened for reading /proc/31/cmdline arm5.elf File opened for reading /proc/300/fd arm5.elf File opened for reading /proc/657/fd arm5.elf File opened for reading /proc/712/cmdline arm5.elf File opened for reading /proc/363/fd arm5.elf File opened for reading /proc/721/fd arm5.elf File opened for reading /proc/724/cmdline arm5.elf File opened for reading /proc/363/cmdline arm5.elf File opened for reading /proc/346/fd arm5.elf File opened for reading /proc/716/cmdline arm5.elf File opened for reading /proc/33/cmdline arm5.elf File opened for reading /proc/26/cmdline arm5.elf File opened for reading /proc/34/cmdline arm5.elf File opened for reading /proc/210/cmdline arm5.elf File opened for reading /proc/682/fd arm5.elf File opened for reading /proc/56/cmdline arm5.elf File opened for reading /proc/716/fd arm5.elf File opened for reading /proc/2/cmdline arm5.elf File opened for reading /proc/212/cmdline arm5.elf File opened for reading /proc/714/cmdline arm5.elf File opened for reading /proc/732/cmdline arm5.elf File opened for reading /proc/686/cmdline arm5.elf File opened for reading /proc/641/fd arm5.elf File opened for reading /proc/9/cmdline arm5.elf