Overview

overview

10

Static

static

5

sever1078.arm7.elf

debian-12-armhf

10

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    18/09/2026, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sever1078.arm7.elf
  • Size 261KB
  • Sample260918-sd87wsxdmc
  • SHA256 fe6c540c57cc17b28c6f26bde4cf06d7b1f2d274953ba9fbc76f8cbcc9aabe8d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

Malware Config

Extracted

Family

  • mirai

C2

  • bigbigvol.qd.je

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Contacts a large (22417) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Executes dropped EXE 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Writes file to system bin folder 2 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 7 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 3 IoCs

    Execute scripts via Unix Shell.

    execution
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/sever1078.arm7.elf
    /tmp/sever1078.arm7.elf
    1⤵
    • Executes dropped EXE
    • Modifies systemd
    • Reads runtime system information
    PID:785
    • /bin/sh
      /bin/sh -c "(crontab -l 2>/dev/null | grep -v '/var/tmp/.sysd' | crontab - 2>/dev/null) >/dev/null 2>&1"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:790
      • /usr/bin/crontab
        crontab -
        3⤵
        • Creates/modifies Cron job
        PID:796
      • /usr/bin/grep
        grep -v /var/tmp/.sysd
        3⤵
        • Reads runtime system information
        PID:795
      • /usr/bin/crontab
        crontab -l
        3⤵
          PID:794
      • /bin/sh
        /bin/sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable systemd-network-update.service 2>/dev/null; systemctl start systemd-network-update.service 2>/dev/null"
        2⤵
        • Command and Scripting Interpreter: Unix Shell
        PID:807
        • /usr/bin/systemctl
          systemctl daemon-reload
          3⤵
            PID:808
          • /usr/bin/systemctl
            systemctl enable systemd-network-update.service
            3⤵
            • Reads runtime system information
            PID:831
          • /usr/bin/systemctl
            systemctl start systemd-network-update.service
            3⤵
            • Reads runtime system information
            PID:849
      • /var/tmp/.sysd
        /var/tmp/.sysd
        1⤵
        • Modifies Watchdog functionality
        • Enumerates active TCP sockets
        • Writes file to system bin folder
        • Changes its process name
        • Reads system network configuration
        • Reads runtime system information
        PID:785
        • /bin/sh
          /bin/sh -c "(crontab -l 2>/dev/null | grep -v '/var/tmp/.sysd' | crontab - 2>/dev/null) >/dev/null 2>&1"
          2⤵
          • Command and Scripting Interpreter: Unix Shell
          PID:851
          • /usr/bin/grep
            grep -v /var/tmp/.sysd
            3⤵
            • Reads runtime system information
            PID:854
          • /usr/bin/crontab
            crontab -l
            3⤵
              PID:853
            • /usr/bin/crontab
              crontab -
              3⤵
              • Creates/modifies Cron job
              PID:855

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              Unix Shell

              1
              T1059.004

              Scheduled Task/Job

              1
              T1053

              Cron

              1
              T1053.003

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              XDG Autostart Entries

              1
              T1547.013

              Create or Modify System Process

              1
              T1543

              Systemd Service

              1
              T1543.002

              Scheduled Task/Job

              1
              T1053

              Cron

              1
              T1053.003

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              XDG Autostart Entries

              1
              T1547.013

              Create or Modify System Process

              1
              T1543

              Systemd Service

              1
              T1543.002

              Scheduled Task/Job

              1
              T1053

              Cron

              1
              T1053.003

              Defense Evasion

              Impair Defenses

              1
              T1562

              Credential Access

              Discovery

              Network Service Discovery

              2
              T1046

              System Network Configuration Discovery

              1
              T1016

              Internet Connection Discovery

              1
              T1016.001

              System Network Connections Discovery

              1
              T1049

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              systemd-network-update.service
              • Path /etc/systemd/system/systemd-network-update.service
              • Size 184B
              • SHA256 2c0ed8e36e0603c11ba5613314d2bd2605e25777a5179c6264da034367c7c21c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              tmp.TptPE6
              • Path /var/spool/cron/crontabs/tmp.TptPE6
              • Size 175B
              • SHA256 3615a26cea238e0ac7b3fb5b1143942df43d6acb965d55047bcc0868b2c992b8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              tmp.rpIdZD
              • Path /var/spool/cron/crontabs/tmp.rpIdZD
              • Size 175B
              • SHA256 3f6203e41af492e7b129c6ac56b92a3d4e22dd021832c4d3fc2155e843c8a5f8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              .sysd
              • Path /var/tmp/.sysd
              • Size 261KB
              • SHA256 fe6c540c57cc17b28c6f26bde4cf06d7b1f2d274953ba9fbc76f8cbcc9aabe8d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              .sysd.lock
              • Path /var/tmp/.sysd.lock
              • Size 4B
              • SHA256 f1aca6f974237101f9218438c624085f95f8d3eebe9ff64ce5d36336a4bb5ad8
              • MD5 SHA1 SHA512
              Submit Download