Overview

overview

7

Static

static

1

wife.arm7.elf

debian-12-armhf

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    30/09/2026, 04:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    wife.arm7.elf
  • Size 200KB
  • Sample260930-fdlelstsax
  • SHA256 134e012f340b9616787422c7e9d3d3db43f83abb1e19efc613bcf1c433ff992a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Creates/modifies Cron job 1 TTPs 3 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 5 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Write file to user bin folder 4 IoCs
    persistence
  • Modifies Bash startup script 2 TTPs 5 IoCs
    persistence
  • Changes its process name 1 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 6 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/wife.arm7.elf
    /tmp/wife.arm7.elf
    1⤵
    • Deletes itself
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Write file to user bin folder
    • Modifies Bash startup script
    • Changes its process name
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:789

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1053

        Cron

        1
        T1053.003

        Persistence

        Boot or Logon Autostart Execution

        4
        T1547

        XDG Autostart Entries

        1
        T1547.013

        Boot or Logon Initialization Scripts

        2
        T1037

        RC Scripts

        2
        T1037.004

        Create or Modify System Process

        1
        T1543

        Systemd Service

        1
        T1543.002

        Event Triggered Execution

        1
        T1546

        Unix Shell Configuration Modification

        1
        T1546.004

        Hijack Execution Flow

        1
        T1574

        Path Interception by PATH Environment Variable

        1
        T1574.007

        Scheduled Task/Job

        1
        T1053

        Cron

        1
        T1053.003

        Privilege Escalation

        Boot or Logon Autostart Execution

        4
        T1547

        XDG Autostart Entries

        1
        T1547.013

        Boot or Logon Initialization Scripts

        2
        T1037

        RC Scripts

        2
        T1037.004

        Create or Modify System Process

        1
        T1543

        Systemd Service

        1
        T1543.002

        Event Triggered Execution

        1
        T1546

        Unix Shell Configuration Modification

        1
        T1546.004

        Hijack Execution Flow

        1
        T1574

        Path Interception by PATH Environment Variable

        1
        T1574.007

        Scheduled Task/Job

        1
        T1053

        Cron

        1
        T1053.003

        Defense Evasion

        Hijack Execution Flow

        1
        T1574

        Path Interception by PATH Environment Variable

        1
        T1574.007

        Credential Access

        Discovery

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        kworker
        • Path /etc/cron.d/kworker
        • Size 113B
        • SHA256 13f0acdbf55ce1f4cbe4bd66a713a6f2baf97893eccccf22f47dbda38e5206a5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kworker
        • Path /etc/cron.hourly/kworker
        • Size 59B
        • SHA256 3c4b5f0b1063049c971210ae2d5632494a04841b2d17f42e7dbaafffdb32d361
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kworker
        • Path /etc/dhcp/dhclient-enter-hooks.d/kworker
        • Size 75B
        • SHA256 20dee1d5f755cef80a1d8fb6a589da294664c2880849a2c61b58a9e2fa916bc3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kworker
        • Path /etc/init.d/kworker
        • Size 118B
        • SHA256 eb5be8efa8827ad8257775ca199bd29fa4f20a1e4cc8a3e6d9dd381efbc20e4d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kworker.sh
        • Path /etc/profile.d/kworker.sh
        • Size 66B
        • SHA256 afdf673e11a9cc7d0df7751150559fe51ca70d9498212fa8b5b59738e5c7e4f5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sshrc
        • Path /etc/ssh/sshrc
        • Size 65B
        • SHA256 53896701c660762c02318d61d5040dfc445ed29d786a258e975cbc22c4215af5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kworker.service
        • Path /etc/systemd/system/kworker.service
        • Size 219B
        • SHA256 da117dd0b8c7f6f576abac1c412c7f120a47a7b1a182b72bdc7629a99d943d0d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kworker
        • Path /etc/update-motd.d/kworker
        • Size 66B
        • SHA256 c0dc3521aebc636e00344fb1eecd1511dcfa6a2d87a3f91f5de61ce6fa2945ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        .kwlog
        • Path /tmp/.kwlog
        • Size 329B
        • SHA256 e50fe828203b8290bd571d85c2478f78efcf95f90bbd835c37b64fdc926175c0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ksoftirqd.792.tmp
        • Path /usr/bin/ksoftirqd.792.tmp
        • Size 200KB
        • SHA256 134e012f340b9616787422c7e9d3d3db43f83abb1e19efc613bcf1c433ff992a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        root
        • Path /var/spool/cron/crontabs/root
        • Size 62B
        • SHA256 d6c191645f68f9681590f97c09b444992ed52f693c046c877e19a70e22a77ab1
        • MD5 SHA1 SHA512 TLSH
        Submit Download