727b21b58d8ac9cc57aa26951c1acb1ea0ac7027310b0e9e00855a6a0c426130

Analysis

max time kernel
149s
max time network
149s
platform
debian-9_armhf
resource
debian9-armhf-20250610-en
resource tags

arch:armhfimage:debian9-armhf-20250610-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
17/06/2025, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
arm926t.elf
Size 469KB
Sample250617-e78assspv2
SHA256 727b21b58d8ac9cc57aa26951c1acb1ea0ac7027310b0e9e00855a6a0c426130
MD5 00a3d9f0a1719f680797acd6ad0aff95
SHA1 05717f4df2a12332d61d9ec3cf3fbf4c64b64266
SHA512 1ce6e216a42d11ca0bb021c4023a8986874642836696cb4c6306683c68f1818af9150e879e98484278d82e17daebd4f856d15123181c81492c43e31b5d3d9d55
SSDEEP 12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Renames itself 1 IoCs

pid	Process
647	arm926t.elf

Checks hardware identifiers (DMI) 1 TTPs 2 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	configuration
File opened for reading	/sys/class/dmi/id/board_vendor	configuration

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.yoDKR0	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads MAC address of network interface 2 TTPs 1 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/eth0/address	configuration

Reads hardware information 1 TTPs 4 IoCs

Accesses system info like serial numbers, manufacturer names etc.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/class/dmi/id/product_uuid	configuration
File opened for reading	/sys/devices/virtual/dmi/id/board_name	configuration
File opened for reading	/sys/devices/virtual/dmi/id/product_uuid	configuration
File opened for reading	/sys/class/dmi/id/board_name	configuration

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	configuration

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/class/net	configuration

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/652/cmdline	configuration
File opened for reading	/proc/85/cmdline	configuration
File opened for reading	/proc/667/cmdline	configuration
File opened for reading	/proc/15/cmdline	configuration
File opened for reading	/proc/27/cmdline	configuration
File opened for reading	/proc/177/cmdline	configuration
File opened for reading	/proc/307/cmdline	configuration
File opened for reading	/proc/680/cmdline	configuration
File opened for reading	/proc/302/cmdline	configuration
File opened for reading	/proc/7/cmdline	configuration
File opened for reading	/proc/606/cmdline	configuration
File opened for reading	/proc/656/cmdline	configuration
File opened for reading	/proc/2/cmdline	configuration
File opened for reading	/proc/16/cmdline	configuration
File opened for reading	/proc/19/cmdline	configuration
File opened for reading	/proc/25/cmdline	configuration
File opened for reading	/proc/158/cmdline	configuration
File opened for reading	/proc/1/cmdline	configuration
File opened for reading	/proc/9/cmdline	configuration
File opened for reading	/proc/13/cmdline	configuration
File opened for reading	/proc/29/cmdline	configuration
File opened for reading	/proc/289/cmdline	configuration
File opened for reading	/proc/298/cmdline	configuration
File opened for reading	/proc/644/cmdline	configuration
File opened for reading	/proc/646/cmdline	configuration
File opened for reading	/proc/6/cmdline	configuration
File opened for reading	/proc/22/cmdline	configuration
File opened for reading	/proc/24/cmdline	configuration
File opened for reading	/proc/168/cmdline	configuration
File opened for reading	/proc/337/cmdline	configuration
File opened for reading	/proc/4/cmdline	configuration
File opened for reading	/proc/107/cmdline	configuration
File opened for reading	/proc/330/cmdline	configuration
File opened for reading	/proc/10/cmdline	configuration
File opened for reading	/proc/26/cmdline	configuration
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/117/cmdline	configuration
File opened for reading	/proc/595/cmdline	configuration
File opened for reading	/proc/150/cmdline	configuration
File opened for reading	/proc/11/cmdline	configuration
File opened for reading	/proc/12/cmdline	configuration
File opened for reading	/proc/14/cmdline	configuration
File opened for reading	/proc/17/cmdline	configuration
File opened for reading	/proc/18/cmdline	configuration
File opened for reading	/proc/21/cmdline	configuration
File opened for reading	/proc/28/cmdline	configuration
File opened for reading	/proc/42/cmdline	configuration
File opened for reading	/proc/311/cmdline	configuration
File opened for reading	/proc/41/cmdline	configuration
File opened for reading	/proc/118/cmdline	configuration
File opened for reading	/proc/593/cmdline	configuration
File opened for reading	/proc/641/cmdline	configuration
File opened for reading	/proc/5/cmdline	configuration
File opened for reading	/proc/20/cmdline	configuration
File opened for reading	/proc/115/cmdline	configuration
File opened for reading	/proc/324/cmdline	configuration
File opened for reading	/proc/575/cmdline	configuration
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/3/cmdline	configuration
File opened for reading	/proc/23/cmdline	configuration
File opened for reading	/proc/645/cmdline	configuration
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/mounts	configuration
File opened for reading	/proc/8/cmdline	configuration

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/root1086f3d	configuration

/tmp/arm926t.elf
/tmp/arm926t.elf
1⤵
- Renames itself
PID:647
- /bin/sh
  sh -c "crontab -l"
  2⤵
  PID:649
- - /usr/bin/crontab
    crontab -l
    3⤵
    - Reads runtime system information
    PID:650
- /bin/sh
  sh -c "(crontab -l ; echo \"@reboot /root/.sys/configuration\")| crontab -"
  2⤵
  PID:657
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    - Reads runtime system information
    PID:659
- - /usr/bin/crontab
    crontab -l
    3⤵
    - Reads runtime system information
    PID:661

/root/.sys/configuration
/tmp/arm926t.elf
1⤵
- Checks hardware identifiers (DMI)
- Reads MAC address of network interface
- Reads hardware information
- Checks CPU configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:647

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp.yoDKR0

Path /var/spool/cron/crontabs/tmp.yoDKR0
Size 208B
SHA256 ce503bb2f7ed48da4b46f1f9c834e28409b7fc31c3b949acd83eb8e464f4fd81
MD5 78788b6f7e4d5bfc25411249c9acc332
SHA1 8694f544ebe038b0ff0322e64d54cf9446ac06dd
SHA512 857903e546176e996f926450d7435af105c7a3f9c590d71cbedd56dd03cdd29f6c8e61be28cb96d740dfd7bb08363c656a9f80d0bfaee266debc320fb07e6f7e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads