Overview

overview

9

Static

static

5

arm6.elf

debian-12-armhf

9

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    22/09/2026, 04:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    arm6.elf
  • Size 58KB
  • Sample260922-fd23csvxdz
  • SHA256 656e539abc54f262eabb6d091df50f9bec71a55905421f0a3fc2eb451aa0409e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationupx

Malware Config

Signatures

  • Contacts a large (10170) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Deletes itself 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs

    Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates/modifies Cron job 1 TTPs 6 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 11 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 2 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Modifies Bash startup script 2 TTPs 11 IoCs
    persistence
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Creates a desktop entry file 3 TTPs 1 IoCs

    A .desktop file is used by desktop environments to register and launch applications. This can be abused to gain persistence.

    persistenceexecution
  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/arm6.elf
    /tmp/arm6.elf
    1⤵
    • Deletes itself
    • Modifies Watchdog functionality
    • Modifies the /etc/hosts DNS resolution file
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Modifies Bash startup script
    • Creates a desktop entry file
    • Reads runtime system information
    PID:785
    • /bin/sh
      sh -c "crontab -l 2>/dev/null"
      2⤵
        PID:793
        • /usr/bin/crontab
          crontab -l
          3⤵
            PID:796
        • /bin/sh
          sh -c "(crontab -l 2>/dev/null; echo '@reboot /usr/lib/mdev-trigger') | crontab - 2>/dev/null"
          2⤵
            PID:802
            • /usr/bin/crontab
              crontab -l
              3⤵
                PID:805
              • /usr/bin/crontab
                crontab -
                3⤵
                • Creates/modifies Cron job
                PID:804
            • /bin/sh
              sh -c "nvram set rc_startup=\"/usr/lib/mdev-trigger &\""
              2⤵
                PID:808
              • /bin/sh
                sh -c "nvram set bootcmd=\"/usr/lib/mdev-trigger &\""
                2⤵
                  PID:809
                • /bin/sh
                  sh -c "nvram set pss_start_script=\"/usr/lib/mdev-trigger\""
                  2⤵
                  • System Network Configuration Discovery
                  PID:812
                • /bin/sh
                  sh -c "nvram set script_start=\"/usr/lib/mdev-trigger &\""
                  2⤵
                  • System Network Configuration Discovery
                  PID:813
                • /bin/sh
                  sh -c "nvram commit"
                  2⤵
                    PID:814
                  • /bin/sh
                    sh -c "flash set STARTUP_CMD \"/usr/lib/mdev-trigger &\""
                    2⤵
                      PID:815
                    • /bin/chattr
                      chattr +i /etc/systemd/system/mdev-trigger.service
                      2⤵
                        PID:817
                      • /bin/chattr
                        chattr +i /etc/init.d/mdev-trigger
                        2⤵
                          PID:818
                        • /bin/chattr
                          chattr +i /usr/lib/mdev-trigger
                          2⤵
                            PID:816
                          • /bin/busybox
                            chattr +i /etc/systemd/system/mdev-trigger.service
                            2⤵
                              PID:820
                            • /bin/busybox
                              chattr +i /etc/init.d/mdev-trigger
                              2⤵
                                PID:821
                              • /bin/busybox
                                chattr +i /usr/lib/mdev-trigger
                                2⤵
                                  PID:819

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Cron

                                    1
                                    T1053.003

                                    User Execution

                                    2
                                    T1204

                                    Malicious File

                                    1
                                    T1204.002

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    5
                                    T1547

                                    XDG Autostart Entries

                                    2
                                    T1547.013

                                    Boot or Logon Initialization Scripts

                                    2
                                    T1037

                                    RC Scripts

                                    2
                                    T1037.004

                                    Create or Modify System Process

                                    1
                                    T1543

                                    Systemd Service

                                    1
                                    T1543.002

                                    Event Triggered Execution

                                    1
                                    T1546

                                    Unix Shell Configuration Modification

                                    1
                                    T1546.004

                                    Hijack Execution Flow

                                    1
                                    T1574

                                    Path Interception by PATH Environment Variable

                                    1
                                    T1574.007

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Cron

                                    1
                                    T1053.003

                                    Privilege Escalation

                                    Boot or Logon Autostart Execution

                                    5
                                    T1547

                                    XDG Autostart Entries

                                    2
                                    T1547.013

                                    Boot or Logon Initialization Scripts

                                    2
                                    T1037

                                    RC Scripts

                                    2
                                    T1037.004

                                    Create or Modify System Process

                                    1
                                    T1543

                                    Systemd Service

                                    1
                                    T1543.002

                                    Event Triggered Execution

                                    1
                                    T1546

                                    Unix Shell Configuration Modification

                                    1
                                    T1546.004

                                    Hijack Execution Flow

                                    1
                                    T1574

                                    Path Interception by PATH Environment Variable

                                    1
                                    T1574.007

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Cron

                                    1
                                    T1053.003

                                    Defense Evasion

                                    Hijack Execution Flow

                                    1
                                    T1574

                                    Path Interception by PATH Environment Variable

                                    1
                                    T1574.007

                                    Impair Defenses

                                    1
                                    T1562

                                    Credential Access

                                    Adversary-in-the-Middle

                                    1
                                    T1557

                                    Discovery

                                    Network Service Discovery

                                    2
                                    T1046

                                    System Network Configuration Discovery

                                    1
                                    T1016

                                    Lateral Movement

                                    Collection

                                    Adversary-in-the-Middle

                                    1
                                    T1557

                                    Command and Control

                                    Exfiltration

                                    Impact

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    ouroboros
                                    • Path /etc/cron.d/ouroboros
                                    • Size 75B
                                    • SHA256 aaab7851dbc6f80319aeb730f4819fb6275ac2096d3a03e0644ad014f1f7dd2a
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    ouroboros-heal
                                    • Path /etc/cron.d/ouroboros-heal
                                    • Size 237B
                                    • SHA256 697ad4e21079f98767d35540d05bd8e3fd204011e10552af52ce4e1b592d5089
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    99-ouroboros
                                    • Path /etc/dhcp/dhclient-exit-hooks.d/99-ouroboros
                                    • Size 66B
                                    • SHA256 e16a81121a53d5630f17b21ecda5773bfa99fa527fad83607a88171b1ffebf66
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    mdev-trigger
                                    • Path /etc/init.d/mdev-trigger
                                    • Size 373B
                                    • SHA256 ba006ac8b6465490145ebfee64227ae68e4ca35f38e710118d1ca85c87038ae6
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    ouroboros.sh
                                    • Path /etc/profile.d/ouroboros.sh
                                    • Size 56B
                                    • SHA256 35efe924fd44192f2c683c99aa4f65c59e568d60204922b3542a26600f5a7390
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    mdev-trigger.service
                                    • Path /etc/systemd/system/mdev-trigger.service
                                    • Size 188B
                                    • SHA256 428f778fbc16eb6e26243536fde1be0bdf2797e87a4def384d3b3345db9a60c1
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    network-dispatch.service
                                    • Path /etc/systemd/system/network-dispatch.service
                                    • Size 183B
                                    • SHA256 c283255038b952ae006aa89fc0433c48ccaffa25611478385a9aa9d52e38d4bc
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    99-ouroboros.rules
                                    • Path /etc/udev/rules.d/99-ouroboros.rules
                                    • Size 126B
                                    • SHA256 ae764ef3980f2feb598a76b369725e713d9875de38ac13ebb92b88c828aaaec6
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    .ashrc
                                    • Path /root/.ashrc
                                    • Size 57B
                                    • SHA256 480842a9581cd697ca23b3005007966fa19d68df7bde3687e1a72c4613730f6c
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    mdev-trigger
                                    • Path /usr/lib/mdev-trigger
                                    • Size 58KB
                                    • SHA256 656e539abc54f262eabb6d091df50f9bec71a55905421f0a3fc2eb451aa0409e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    tmp.jbxizz
                                    • Path /var/spool/cron/crontabs/tmp.jbxizz
                                    • Size 205B
                                    • SHA256 65ac993989a9d21d9d966a83101be3fc0aed50bc802fa5a507fa02d084f300dc
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download