Overview

overview

7

Static

static

1

kaf.arm7.elf

debian-12-armhf

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260127-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    17/05/2026, 15:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    kaf.arm7.elf
  • Size 839KB
  • Sample260517-tecqraay81
  • SHA256 38aec4b665a9a6100a96bbffe6eda55d6661319e93efd4a5d5b723ae2227ff1a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Changes its process name 1 IoCs
  • Reads runtime system information 4 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/kaf.arm7.elf
    /tmp/kaf.arm7.elf
    1⤵
    • Modifies rc script
    • Modifies systemd
    • Changes its process name
    • Writes file to tmp directory
    PID:794
    • /bin/sh
      sh -c -- "(crontab -l 2>/dev/null | grep -v '/tmp/kaf.arm7.elf'; echo '@reboot /tmp/kaf.arm7.elf'; echo '*/5 * * * * /tmp/kaf.arm7.elf') | crontab - 2>/dev/null"
      2⤵
        PID:810
        • /usr/bin/crontab
          crontab -
          3⤵
          • Creates/modifies Cron job
          PID:812
        • /usr/bin/crontab
          crontab -l
          3⤵
            PID:813
          • /usr/bin/grep
            grep -v /tmp/kaf.arm7.elf
            3⤵
            • Reads runtime system information
            PID:814
        • /bin/sh
          sh -c -- "systemctl daemon-reload"
          2⤵
            PID:815
            • /usr/bin/systemctl
              systemctl daemon-reload
              3⤵
              • Reads runtime system information
              PID:816
          • /bin/sh
            sh -c -- "systemctl enable toxnet.service"
            2⤵
              PID:832
              • /usr/bin/systemctl
                systemctl enable toxnet.service
                3⤵
                • Reads runtime system information
                PID:833
            • /bin/sh
              sh -c -- "systemctl start toxnet.service"
              2⤵
                PID:849
                • /usr/bin/systemctl
                  systemctl start toxnet.service
                  3⤵
                  • Reads runtime system information
                  PID:850

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  rc.local
                  • Path /etc/rc.local
                  • Size 20B
                  • SHA256 8b3739e37ebdf630e7caae93e04517b166531b38030bdef509a4cc7188f67da0
                  • MD5 SHA1 SHA512
                  Submit Download

                  toxnet.service
                  • Path /etc/systemd/system/toxnet.service
                  • Size 169B
                  • SHA256 3df5e1256b51d557c7430a680dd0be283745f08053ee4aa7fbfd2ce8fc5a62e0
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  tmp.py1yDK
                  • Path /var/spool/cron/crontabs/tmp.py1yDK
                  • Size 231B
                  • SHA256 82158807161dd4ff7a35de75a286dcd2d683d79ace37f6ed387c425e9b06ec60
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download