Overview

overview

10

Static

static

5

sever1078.arm7.elf

debian-12-armhf

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    19/09/2026, 10:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sever1078.arm7.elf
  • Size 262KB
  • Sample260919-mcmdvaeb34
  • SHA256 358d91e2c9db2715dffad77cbd054d3f628039bfef32ee94b427da8415c31641
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

Malware Config

Extracted

Family

  • mirai

C2

  • bigbigvol.qd.je

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Contacts a large (22415) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Executes dropped EXE 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Writes file to system bin folder 2 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 7 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 3 IoCs

    Execute scripts via Unix Shell.

    execution
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/sever1078.arm7.elf
    /tmp/sever1078.arm7.elf
    1⤵
    • Executes dropped EXE
    • Modifies systemd
    PID:782
    • /bin/sh
      /bin/sh -c "(crontab -l 2>/dev/null | grep -v '/var/tmp/.sysd' | crontab - 2>/dev/null) >/dev/null 2>&1"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:790
      • /usr/bin/grep
        grep -v /var/tmp/.sysd
        3⤵
          PID:795
        • /usr/bin/crontab
          crontab -l
          3⤵
            PID:794
          • /usr/bin/crontab
            crontab -
            3⤵
            • Creates/modifies Cron job
            PID:796
        • /bin/sh
          /bin/sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable systemd-network-update.service 2>/dev/null; systemctl start systemd-network-update.service 2>/dev/null"
          2⤵
          • Command and Scripting Interpreter: Unix Shell
          PID:808
          • /usr/bin/systemctl
            systemctl daemon-reload
            3⤵
            • Reads runtime system information
            PID:809
          • /usr/bin/systemctl
            systemctl enable systemd-network-update.service
            3⤵
            • Reads runtime system information
            PID:829
          • /usr/bin/systemctl
            systemctl start systemd-network-update.service
            3⤵
              PID:847
        • /var/tmp/.sysd
          /var/tmp/.sysd
          1⤵
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Writes file to system bin folder
          • Changes its process name
          • Reads system network configuration
          • Reads runtime system information
          PID:782
          • /bin/sh
            /bin/sh -c "(crontab -l 2>/dev/null | grep -v '/var/tmp/.sysd' | crontab - 2>/dev/null) >/dev/null 2>&1"
            2⤵
            • Command and Scripting Interpreter: Unix Shell
            PID:849
            • /usr/bin/crontab
              crontab -l
              3⤵
                PID:851
              • /usr/bin/grep
                grep -v /var/tmp/.sysd
                3⤵
                  PID:852
                • /usr/bin/crontab
                  crontab -
                  3⤵
                  • Creates/modifies Cron job
                  PID:853

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  1
                  T1059

                  Unix Shell

                  1
                  T1059.004

                  Scheduled Task/Job

                  1
                  T1053

                  Cron

                  1
                  T1053.003

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  XDG Autostart Entries

                  1
                  T1547.013

                  Create or Modify System Process

                  1
                  T1543

                  Systemd Service

                  1
                  T1543.002

                  Scheduled Task/Job

                  1
                  T1053

                  Cron

                  1
                  T1053.003

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  XDG Autostart Entries

                  1
                  T1547.013

                  Create or Modify System Process

                  1
                  T1543

                  Systemd Service

                  1
                  T1543.002

                  Scheduled Task/Job

                  1
                  T1053

                  Cron

                  1
                  T1053.003

                  Defense Evasion

                  Impair Defenses

                  1
                  T1562

                  Credential Access

                  Discovery

                  Network Service Discovery

                  2
                  T1046

                  System Network Configuration Discovery

                  1
                  T1016

                  Internet Connection Discovery

                  1
                  T1016.001

                  System Network Connections Discovery

                  1
                  T1049

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  systemd-network-update.service
                  • Path /etc/systemd/system/systemd-network-update.service
                  • Size 184B
                  • SHA256 2c0ed8e36e0603c11ba5613314d2bd2605e25777a5179c6264da034367c7c21c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  tmp.Dpnu7V
                  • Path /var/spool/cron/crontabs/tmp.Dpnu7V
                  • Size 175B
                  • SHA256 ba16f4bbbdf2db442645628a76aaf7e369e1c0d0c5cf3dd3ea2a8d4034e24042
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  tmp.rloSHT
                  • Path /var/spool/cron/crontabs/tmp.rloSHT
                  • Size 175B
                  • SHA256 ffbcdb94294053757ce399fd894e1bae715df2e7752b11dba724f894dd2cca07
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  .sysd
                  • Path /var/tmp/.sysd
                  • Size 262KB
                  • SHA256 358d91e2c9db2715dffad77cbd054d3f628039bfef32ee94b427da8415c31641
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  .sysd.lock
                  • Path /var/tmp/.sysd.lock
                  • Size 4B
                  • SHA256 2b52988e6a5f86d72ecf8b59fa8ed58a174663d54001db9db8190f9692fb1489
                  • MD5 SHA1 SHA512
                  Submit Download