e6302aad7ada45983d3a22c525b47e5c5ab6000daab5febcc0a414fbc49a1a32

General

Target
bot.armv7.elf
Size 990KB
Sample260928-e927kage84
SHA256 e6302aad7ada45983d3a22c525b47e5c5ab6000daab5febcc0a414fbc49a1a32
MD5 9bc52d4f4198c723b3762770e1ea55b9
SHA1 5797cd4f790452831a1cd0c73f580061d360c433
SHA512 4fe52aa76a9ca477f38964eee872df6d6b9b47571fb7d89917f689dc7595a5cee6f84020e25767a339c3c05aba2ed05750f1b03629f8db7d5172b19ba4ebf771
SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmr:KdM4DmUj657yDAmr
TLSH
T1A1254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  bot.armv7.elf
- Size 990KB
- SHA256 e6302aad7ada45983d3a22c525b47e5c5ab6000daab5febcc0a414fbc49a1a32
- MD5 9bc52d4f4198c723b3762770e1ea55b9
- SHA1 5797cd4f790452831a1cd0c73f580061d360c433
- SHA512 4fe52aa76a9ca477f38964eee872df6d6b9b47571fb7d89917f689dc7595a5cee6f84020e25767a339c3c05aba2ed05750f1b03629f8db7d5172b19ba4ebf771
- SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmr:KdM4DmUj657yDAmr
- TLSH
  T1A1254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm credential_access defense_evasion discovery execution persistence privilege_escalation
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
- Reads AppArmor ptrace settings
  Discovery of allowed ptrace capabilities by AppArmor.
  discovery
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads MAC address of network interface
  Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
  defense_evasion discovery
- Reads network interface configuration
  Fetches information about one or more active network interfaces.
  discovery
- Schedules an At job
  Schedules a job to be run using the at command.
  execution persistence privilege_escalation
- Uses Polkit to run commands
  Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.
behavioral1