b8c03e6a150cc5991684b6ef24a614500e9e38368a188e70b2fd0f658c8db0d3

General

Target
bot.armv7l.elf
Size 990KB
Sample260929-2mrtms1tbw
SHA256 b8c03e6a150cc5991684b6ef24a614500e9e38368a188e70b2fd0f658c8db0d3
MD5 e1127f83ba63eca2c59868d4d1317b28
SHA1 788c70ac503e02398a5cf9c5534a705590240329
SHA512 559e8a903d0fa9c9a4dd63f01d0b7e1804c21a642994d08be9bc9594e175aff43c4ed05dc75e4dbad22f997c752efcb1883ec4672b06c2eb90e4dd281e0f32e2
SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmx:KdM4DmUj657yDAmx
TLSH
T1B9254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  bot.armv7l.elf
- Size 990KB
- SHA256 b8c03e6a150cc5991684b6ef24a614500e9e38368a188e70b2fd0f658c8db0d3
- MD5 e1127f83ba63eca2c59868d4d1317b28
- SHA1 788c70ac503e02398a5cf9c5534a705590240329
- SHA512 559e8a903d0fa9c9a4dd63f01d0b7e1804c21a642994d08be9bc9594e175aff43c4ed05dc75e4dbad22f997c752efcb1883ec4672b06c2eb90e4dd281e0f32e2
- SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmx:KdM4DmUj657yDAmx
- TLSH
  T1B9254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm credential_access defense_evasion discovery execution persistence privilege_escalation
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
- Reads AppArmor ptrace settings
  Discovery of allowed ptrace capabilities by AppArmor.
  discovery
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads MAC address of network interface
  Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
  defense_evasion discovery
- Reads network interface configuration
  Fetches information about one or more active network interfaces.
  discovery
- Schedules an At job
  Schedules a job to be run using the at command.
  execution persistence privilege_escalation
- Uses Polkit to run commands
  Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.
behavioral1