Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
28/03/2025, 04:09
Static task
static1
Behavioral task
behavioral1
Sample
arm5.elf
Resource
debian9-armhf-20240418-en
debian-9-armhf
8 signatures
150 seconds
General
-
Target
arm5.elf
-
Size
116KB
-
MD5
2801ac08801e960a9e9f1d2abd7f5b4b
-
SHA1
48ba8d8b3ec5d718697835279f637b0ae45b6081
-
SHA256
5b228f994b7fe9ec41e8d1ff535aa7842bce3fc38b03a9009139a31e2077e7f5
-
SHA512
01dee1178b76c3feef9158f8820407d65e074e2a43d0facbbfb9839eff0f5c966314419ba82a25a3394c9e20054c86f69af96c18bfe2dcbd0408301879954854
-
SSDEEP
3072:RBmKyo0CgHtFdRtoH0skJkZaWL4YuBRBG6f3ON1LknQ/:RBmKyo0CgHtFdH4qJ7W/IRBhf61L
Score
9/10
Malware Config
Signatures
-
Contacts a large (31332) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Renames itself 1 IoCs
pid Process 649 arm5.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 47 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/695/maps arm5.elf File opened for reading /proc/663/maps arm5.elf File opened for reading /proc/676/maps arm5.elf File opened for reading /proc/683/maps arm5.elf File opened for reading /proc/689/maps arm5.elf File opened for reading /proc/602/maps arm5.elf File opened for reading /proc/665/maps arm5.elf File opened for reading /proc/680/maps arm5.elf File opened for reading /proc/687/maps arm5.elf File opened for reading /proc/696/maps arm5.elf File opened for reading /proc/700/maps arm5.elf File opened for reading /proc/298/maps arm5.elf File opened for reading /proc/667/maps arm5.elf File opened for reading /proc/671/maps arm5.elf File opened for reading /proc/674/maps arm5.elf File opened for reading /proc/678/maps arm5.elf File opened for reading /proc/691/maps arm5.elf File opened for reading /proc/698/maps arm5.elf File opened for reading /proc/1/maps arm5.elf File opened for reading /proc/679/maps arm5.elf File opened for reading /proc/684/maps arm5.elf File opened for reading /proc/685/maps arm5.elf File opened for reading /proc/688/maps arm5.elf File opened for reading /proc/699/maps arm5.elf File opened for reading /proc/655/maps arm5.elf File opened for reading /proc/659/maps arm5.elf File opened for reading /proc/664/maps arm5.elf File opened for reading /proc/668/maps arm5.elf File opened for reading /proc/670/maps arm5.elf File opened for reading /proc/675/maps arm5.elf File opened for reading /proc/694/maps arm5.elf File opened for reading /proc/661/maps arm5.elf File opened for reading /proc/662/maps arm5.elf File opened for reading /proc/681/maps arm5.elf File opened for reading /proc/686/maps arm5.elf File opened for reading /proc/690/maps arm5.elf File opened for reading /proc/603/maps arm5.elf File opened for reading /proc/660/maps arm5.elf File opened for reading /proc/666/maps arm5.elf File opened for reading /proc/677/maps arm5.elf File opened for reading /proc/692/maps arm5.elf File opened for reading /proc/693/maps arm5.elf File opened for reading /proc/697/maps arm5.elf File opened for reading /proc/701/maps arm5.elf File opened for reading /proc/297/maps arm5.elf File opened for reading /proc/669/maps arm5.elf File opened for reading /proc/682/maps arm5.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself dvrUpdater 649 arm5.elf -
description ioc Process File opened for reading /proc/655/cmdline arm5.elf File opened for reading /proc/668/cmdline arm5.elf File opened for reading /proc/679/fd arm5.elf File opened for reading /proc/15/cmdline arm5.elf File opened for reading /proc/109/cmdline arm5.elf File opened for reading /proc/662/cmdline arm5.elf File opened for reading /proc/682/cmdline arm5.elf File opened for reading /proc/688/cmdline arm5.elf File opened for reading /proc/690/cmdline arm5.elf File opened for reading /proc/693/fd arm5.elf File opened for reading /proc/694/cmdline arm5.elf File opened for reading /proc/13/cmdline arm5.elf File opened for reading /proc/308/cmdline arm5.elf File opened for reading /proc/41/cmdline arm5.elf File opened for reading /proc/272/cmdline arm5.elf File opened for reading /proc/298/cmdline arm5.elf File opened for reading /proc/596/fd arm5.elf File opened for reading /proc/678/cmdline arm5.elf File opened for reading /proc/699/fd arm5.elf File opened for reading /proc/18/cmdline arm5.elf File opened for reading /proc/22/cmdline arm5.elf File opened for reading /proc/140/cmdline arm5.elf File opened for reading /proc/268/cmdline arm5.elf File opened for reading /proc/26/cmdline arm5.elf File opened for reading /proc/43/cmdline arm5.elf File opened for reading /proc/634/fd arm5.elf File opened for reading /proc/111/cmdline arm5.elf File opened for reading /proc/582/fd arm5.elf File opened for reading /proc/5/cmdline arm5.elf File opened for reading /proc/10/cmdline arm5.elf File opened for reading /proc/142/cmdline arm5.elf File opened for reading /proc/641/fd arm5.elf File opened for reading /proc/663/cmdline arm5.elf File opened for reading /proc/680/cmdline arm5.elf File opened for reading /proc/684/fd arm5.elf File opened for reading /proc/691/fd arm5.elf File opened for reading /proc/12/cmdline arm5.elf File opened for reading /proc/648/cmdline arm5.elf File opened for reading /proc/308/fd arm5.elf File opened for reading /proc/650/fd arm5.elf File opened for reading /proc/692/cmdline arm5.elf File opened for reading /proc/273/cmdline arm5.elf File opened for reading /proc/687/cmdline arm5.elf File opened for reading /proc/697/cmdline arm5.elf File opened for reading /proc/167/cmdline arm5.elf File opened for reading /proc/634/cmdline arm5.elf File opened for reading /proc/670/fd arm5.elf File opened for reading /proc/644/fd arm5.elf File opened for reading /proc/666/cmdline arm5.elf File opened for reading /proc/667/cmdline arm5.elf File opened for reading /proc/689/cmdline arm5.elf File opened for reading /proc/689/fd arm5.elf File opened for reading /proc/20/cmdline arm5.elf File opened for reading /proc/29/cmdline arm5.elf File opened for reading /proc/596/cmdline arm5.elf File opened for reading /proc/685/cmdline arm5.elf File opened for reading /proc/687/fd arm5.elf File opened for reading /proc/691/cmdline arm5.elf File opened for reading /proc/19/cmdline arm5.elf File opened for reading /proc/602/cmdline arm5.elf File opened for reading /proc/665/cmdline arm5.elf File opened for reading /proc/666/fd arm5.elf File opened for reading /proc/674/cmdline arm5.elf File opened for reading /proc/675/cmdline arm5.elf