2bddbd811a2874674b3eaefb1c2a9fa9f66011670dd7ce90b510c6136bcda202

General

Target
bot.armv6.elf
Size 989KB
Sample260929-vfas8abe28
SHA256 2bddbd811a2874674b3eaefb1c2a9fa9f66011670dd7ce90b510c6136bcda202
MD5 01df5148ad21fa22952b32cc6171c6be
SHA1 df4ac94a7d47abd72031129d1ca8321e8bb12db0
SHA512 bd9f9519eabe99a1c2819e64e53f21a57ddf91ba8cd504e0cd5b85e263a162269655382f2d5a679a0f73070838f06ddbb898be556b05b0e5dfba5c2ccc5a7520
SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmg:KdM4DmUj657yDAmg
TLSH
T1DE254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  bot.armv6.elf
- Size 989KB
- SHA256 2bddbd811a2874674b3eaefb1c2a9fa9f66011670dd7ce90b510c6136bcda202
- MD5 01df5148ad21fa22952b32cc6171c6be
- SHA1 df4ac94a7d47abd72031129d1ca8321e8bb12db0
- SHA512 bd9f9519eabe99a1c2819e64e53f21a57ddf91ba8cd504e0cd5b85e263a162269655382f2d5a679a0f73070838f06ddbb898be556b05b0e5dfba5c2ccc5a7520
- SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmg:KdM4DmUj657yDAmg
- TLSH
  T1DE254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm credential_access defense_evasion discovery execution persistence privilege_escalation
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
- Reads AppArmor ptrace settings
  Discovery of allowed ptrace capabilities by AppArmor.
  discovery
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads MAC address of network interface
  Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
  defense_evasion discovery
- Schedules an At job
  Schedules a job to be run using the at command.
  execution persistence privilege_escalation
- Uses Polkit to run commands
  Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.
behavioral1