Analysis
- max time kernel
128s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20250619-en - resource tags
- submitted
08/11/2025, 02:39
General
- Target frost.armv6.elf
- Size 77KB
- Sample251108-c5frnaskgp
- SHA256 f08d8c43beedbc8d45ea133b44dd09e13d80d725846eac7615141dee9064907e
Score
9/10
Malware Config
Signatures
- Contacts a large (29201) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Deletes itself 1 IoCs
- Modifies Watchdog functionality 1 TTPs 1 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Changes its process name 1 IoCs
Processes
-
/tmp/frost.armv6.elf/tmp/frost.armv6.elf1⤵
- Deletes itself
- Modifies Watchdog functionality
- Changes its process name