Overview

overview

7

Static

static

1

arm7.urbot...ss.elf

debian-12-armhf

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20250619-en
  • resource tags

    arch:armhfimage:debian12-armhf-20250619-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    02/10/2025, 22:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    arm7.urbotnetisass.elf
  • Size 232KB
  • Sample251002-2blhgsv1bw
  • SHA256 cbbc768c826536615593040b59c54b05412ce8afd5d1db669db4b24afd275c9c
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
antivmcredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Deletes Audit logs 1 TTPs 1 IoCs

    Deletes logs related to the Linux Audit framework.

    defense_evasion
  • Deletes journal logs 1 TTPs 2 IoCs

    Deletes systemd journal logs. Likely to evade detection.

    defense_evasion
  • Modifies Watchdog functionality 1 TTPs 3 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Checks mountinfo of local process 1 TTPs 1 IoCs

    Checks mountinfo of running processes which indicate if it is running in chroot jail.

    antivm
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 3 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Reads list of loaded kernel modules 1 TTPs 1 IoCs

    Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

    defense_evasion
  • Write file to user bin folder 1 IoCs
    persistence
  • Writes file to system bin folder 1 IoCs
  • Modifies Bash startup script 2 TTPs 3 IoCs
    persistence
  • Reads process memory 1 TTPs 1 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 2 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

    Execute scripts via Unix Shell.

    execution
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 5 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/arm7.urbotnetisass.elf
    /tmp/arm7.urbotnetisass.elf
    1⤵
    • Deletes Audit logs
    • Deletes journal logs
    • Modifies Watchdog functionality
    • Checks mountinfo of local process
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Enumerates active TCP sockets
    • Modifies rc script
    • Reads list of loaded kernel modules
    • Writes file to system bin folder
    • Modifies Bash startup script
    • Reads process memory
    • Checks CPU configuration
    • Reads system network configuration
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:784
    • /bin/sh
      sh -c "cp /tmp/arm7.urbotnetisass.elf /usr/bin/.sh"
      2⤵
        PID:802
        • /usr/bin/cp
          cp /tmp/arm7.urbotnetisass.elf /usr/bin/.sh
          3⤵
          • Write file to user bin folder
          PID:803
      • /bin/sh
        /bin/sh -c "for c in ps kill grep ls cat readlink mount umount awk sed cut wget curl top netstat ss lsof reboot shutdown halt poweroff; do mkfifo /tmp/\$c 2>/dev/null; mount --bind /tmp/\$c /bin/\$c 2>/dev/null; mount --bind /tmp/\$c /usr/bin/\$c 2>/dev/null; mount --bind /tmp/\$c /sbin/\$c 2>/dev/null; mount --bind /tmp/\$c /usr/sbin/\$c 2>/dev/null; done"
        2⤵
        • Command and Scripting Interpreter: Unix Shell
        PID:824

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Unix Shell

          1
          T1059.004

          Scheduled Task/Job

          1
          T1053

          Cron

          1
          T1053.003

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Boot or Logon Initialization Scripts

          1
          T1037

          RC Scripts

          1
          T1037.004

          Event Triggered Execution

          1
          T1546

          Unix Shell Configuration Modification

          1
          T1546.004

          Hijack Execution Flow

          1
          T1574

          Path Interception by PATH Environment Variable

          1
          T1574.007

          Scheduled Task/Job

          1
          T1053

          Cron

          1
          T1053.003

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Boot or Logon Initialization Scripts

          1
          T1037

          RC Scripts

          1
          T1037.004

          Event Triggered Execution

          1
          T1546

          Unix Shell Configuration Modification

          1
          T1546.004

          Hijack Execution Flow

          1
          T1574

          Path Interception by PATH Environment Variable

          1
          T1574.007

          Scheduled Task/Job

          1
          T1053

          Cron

          1
          T1053.003

          Defense Evasion

          Hijack Execution Flow

          1
          T1574

          Path Interception by PATH Environment Variable

          1
          T1574.007

          Impair Defenses

          1
          T1562

          Indicator Removal

          2
          T1070

          Clear Linux or Mac System Logs

          2
          T1070.002

          Virtualization/Sandbox Evasion

          3
          T1497

          System Checks

          2
          T1497.001

          Credential Access

          OS Credential Dumping

          1
          T1003

          Proc Filesystem

          1
          T1003.007

          Discovery

          System Information Discovery

          1
          T1082

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          System Network Connections Discovery

          1
          T1049

          Virtualization/Sandbox Evasion

          3
          T1497

          System Checks

          2
          T1497.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          rc.local
          • Path /etc/rc.local
          • Size 17B
          • SHA256 306c6ca7407560340797866e077e053627ad409277d1b9da58106fce4cf717cb
          • MD5 SHA1 SHA512
          Submit Download

          rc.local
          • Path /etc/rc.local
          • Size 32B
          • SHA256 9128b5050b1505ac764248662656c6ed974739f7c07e28505b6e731772f7e7d5
          • MD5 SHA1 SHA512
          Submit Download

          .broken_shell
          • Path /tmp/.broken_shell
          • Size 137B
          • SHA256 c102dc8cd4c206f5cdc178fc498df4b15dfd43d17123867fffaf44220383c7d4
          • MD5 SHA1 SHA512
          Submit Download

          .mock
          • Path /tmp/.mock
          • Size 388B
          • SHA256 b0082567296e2db8275072c23020cb893dd58ba8b995d49a0d531908f884b19a
          • MD5 SHA1 SHA512
          Submit Download

          .taunt
          • Path /tmp/.taunt
          • Size 796B
          • SHA256 39bd06f3e25159f5fece6db6c7a6e0f25d5be5a46be90bacda7a9ea3d71b95f9
          • MD5 SHA1 SHA512
          Submit Download