Overview

overview

8

Static

static

1

arm7.elf

debian-12-armhf

8

Analysis

  • max time kernel
    149s
  • max time network
    104s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260127-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    03/10/2026, 17:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    arm7.elf
  • Size 438KB
  • Sample261003-warefsteja
  • SHA256 4c49dbbce842ee8489eb38080e2eb258cc15aad68aab77aa1e7a38e691ab948a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Traces remote process 2 IoCs
  • Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs

    Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

  • Creates/modifies Cron job 1 TTPs 5 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 4 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates active TCP sockets 1 TTPs 11 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Modifies Bash startup script 2 TTPs 4 IoCs
    persistence
  • Changes its process name 15 IoCs
  • Reads system network configuration 1 TTPs 11 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 16 IoCs

    Execute scripts via Unix Shell.

    execution
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 33 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/arm7.elf
    /tmp/arm7.elf
    1⤵
    • Traces remote process
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Enumerates active TCP sockets
    • Modifies init.d
    • Modifies Bash startup script
    • Changes its process name
    • Reads system network configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:804
    • /bin/sh
      /bin/sh -c "s�h#41X+ �;�Ni�3"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:868
    • /bin/sh
      /bin/sh -c "/tmp/arm7.elf >/dev/null 2>&1 &"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:879
    • /bin/sh
      /bin/sh -c "/tmp/arm7.elf >/dev/null 2>&1 &"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:886
    • /bin/sh
      /bin/sh -c "/tmp/arm7.elf >/dev/null 2>&1 &"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:888
    • /usr/bin/crontab
      /usr/bin/crontab -l
      2⤵
        PID:891
    • /tmp/arm7.elf
      /tmp/arm7.elf
      1⤵
      • Creates/modifies Cron job
      • Creates/modifies environment variables
      • Enumerates active TCP sockets
      • Modifies Bash startup script
      • Changes its process name
      • Reads system network configuration
      • Reads runtime system information
      • Writes file to tmp directory
      PID:885
      • /bin/sh
        /bin/sh -c "s�h#41X+ �;�Ni�3"
        2⤵
        • Command and Scripting Interpreter: Unix Shell
        PID:944
      • /bin/sh
        /bin/sh -c "/tmp/arm7.elf >/dev/null 2>&1 &"
        2⤵
        • Command and Scripting Interpreter: Unix Shell
        PID:978
      • /bin/sh
        /bin/sh -c "/tmp/arm7.elf >/dev/null 2>&1 &"
        2⤵
        • Command and Scripting Interpreter: Unix Shell
        PID:995
      • /bin/sh
        /bin/sh -c "/tmp/arm7.elf >/dev/null 2>&1 &"
        2⤵
        • Command and Scripting Interpreter: Unix Shell
        PID:1002
      • /usr/bin/crontab
        /usr/bin/crontab -l
        2⤵
          PID:1004
      • /tmp/arm7.elf
        /tmp/arm7.elf
        1⤵
        • Enumerates active TCP sockets
        • Changes its process name
        • Reads system network configuration
        • Reads runtime system information
        • Writes file to tmp directory
        PID:887
      • /tmp/arm7.elf
        /tmp/arm7.elf
        1⤵
        • Enumerates active TCP sockets
        • Changes its process name
        • Reads system network configuration
        • Reads runtime system information
        • Writes file to tmp directory
        PID:890
      • /tmp/arm7.elf
        /tmp/arm7.elf
        1⤵
        • Enumerates active TCP sockets
        • Changes its process name
        • Reads system network configuration
        • Reads runtime system information
        • Writes file to tmp directory
        PID:991
      • /tmp/arm7.elf
        /tmp/arm7.elf
        1⤵
        • Modifies the /etc/hosts DNS resolution file
        • Creates/modifies Cron job
        • Creates/modifies environment variables
        • Enumerates active TCP sockets
        • Modifies systemd
        • Modifies Bash startup script
        • Changes its process name
        • Reads system network configuration
        • Reads runtime system information
        • Writes file to tmp directory
        PID:1001
        • /bin/sh
          /bin/sh -c "s�h#41X+ �;�Ni�3"
          2⤵
          • Command and Scripting Interpreter: Unix Shell
          PID:1100
        • /bin/sh
          /bin/sh -c "/tmp/arm7.elf >/dev/null 2>&1 &"
          2⤵
          • Command and Scripting Interpreter: Unix Shell
          PID:1122
        • /bin/sh
          /bin/sh -c "/tmp/arm7.elf >/dev/null 2>&1 &"
          2⤵
          • Command and Scripting Interpreter: Unix Shell
          PID:1140
        • /bin/sh
          /bin/sh -c "/tmp/arm7.elf >/dev/null 2>&1 &"
          2⤵
          • Command and Scripting Interpreter: Unix Shell
          PID:1146
        • /usr/bin/crontab
          /usr/bin/crontab -l
          2⤵
            PID:1151
        • /tmp/arm7.elf
          /tmp/arm7.elf
          1⤵
          • Enumerates active TCP sockets
          • Changes its process name
          • Reads system network configuration
          • Reads runtime system information
          • Writes file to tmp directory
          PID:1003
        • /tmp/arm7.elf
          /tmp/arm7.elf
          1⤵
          • Creates/modifies Cron job
          • Creates/modifies environment variables
          • Enumerates active TCP sockets
          • Modifies Bash startup script
          • Changes its process name
          • Reads system network configuration
          • Reads runtime system information
          • Writes file to tmp directory
          PID:1137
          • /bin/sh
            /bin/sh -c "s�h#41X+ �;�Ni�3"
            2⤵
            • Command and Scripting Interpreter: Unix Shell
            PID:1326
          • /bin/sh
            /bin/sh -c "/tmp/arm7.elf >/dev/null 2>&1 &"
            2⤵
            • Command and Scripting Interpreter: Unix Shell
            PID:1340
          • /bin/sh
            /bin/sh -c "/tmp/arm7.elf >/dev/null 2>&1 &"
            2⤵
            • Command and Scripting Interpreter: Unix Shell
            PID:1362
          • /bin/sh
            /bin/sh -c "/tmp/arm7.elf >/dev/null 2>&1 &"
            2⤵
            • Command and Scripting Interpreter: Unix Shell
            PID:1389
          • /usr/bin/crontab
            /usr/bin/crontab -l
            2⤵
              PID:1409
          • /tmp/arm7.elf
            /tmp/arm7.elf
            1⤵
            • Enumerates active TCP sockets
            • Changes its process name
            • Reads system network configuration
            • Reads runtime system information
            • Writes file to tmp directory
            PID:1145
          • /tmp/arm7.elf
            /tmp/arm7.elf
            1⤵
            • Enumerates active TCP sockets
            • Changes its process name
            • Reads system network configuration
            • Reads runtime system information
            • Writes file to tmp directory
            PID:1150
          • /tmp/arm7.elf
            /tmp/arm7.elf
            1⤵
            • Enumerates active TCP sockets
            • Changes its process name
            • Reads system network configuration
            • Reads runtime system information
            • Writes file to tmp directory
            PID:1161
          • /tmp/arm7.elf
            /tmp/arm7.elf
            1⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:1356
          • /tmp/arm7.elf
            /tmp/arm7.elf
            1⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:1384
          • /tmp/arm7.elf
            /tmp/arm7.elf
            1⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:1407
          • /tmp/arm7.elf
            /tmp/arm7.elf
            1⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:1424

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                Unix Shell

                1
                T1059.004

                Scheduled Task/Job

                1
                T1053

                Cron

                1
                T1053.003

                Persistence

                Boot or Logon Autostart Execution

                3
                T1547

                XDG Autostart Entries

                1
                T1547.013

                Boot or Logon Initialization Scripts

                1
                T1037

                RC Scripts

                1
                T1037.004

                Create or Modify System Process

                1
                T1543

                Systemd Service

                1
                T1543.002

                Event Triggered Execution

                1
                T1546

                Unix Shell Configuration Modification

                1
                T1546.004

                Hijack Execution Flow

                1
                T1574

                Path Interception by PATH Environment Variable

                1
                T1574.007

                Scheduled Task/Job

                1
                T1053

                Cron

                1
                T1053.003

                Privilege Escalation

                Boot or Logon Autostart Execution

                3
                T1547

                XDG Autostart Entries

                1
                T1547.013

                Boot or Logon Initialization Scripts

                1
                T1037

                RC Scripts

                1
                T1037.004

                Create or Modify System Process

                1
                T1543

                Systemd Service

                1
                T1543.002

                Event Triggered Execution

                1
                T1546

                Unix Shell Configuration Modification

                1
                T1546.004

                Hijack Execution Flow

                1
                T1574

                Path Interception by PATH Environment Variable

                1
                T1574.007

                Scheduled Task/Job

                1
                T1053

                Cron

                1
                T1053.003

                Defense Evasion

                Hijack Execution Flow

                1
                T1574

                Path Interception by PATH Environment Variable

                1
                T1574.007

                Credential Access

                Adversary-in-the-Middle

                1
                T1557

                Discovery

                System Network Configuration Discovery

                1
                T1016

                Internet Connection Discovery

                1
                T1016.001

                System Network Connections Discovery

                1
                T1049

                Lateral Movement

                Collection

                Adversary-in-the-Middle

                1
                T1557

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                sys-daemon
                • Path /etc/cron.d/sys-daemon
                • Size 44B
                • SHA256 961b2c97ae42a56db5607072984c65337a84fdb190dba642bd048932bc57d6b0
                • MD5 SHA1 SHA512
                Submit Download

                sysd
                • Path /etc/init.d/sysd
                • Size 163B
                • SHA256 2d7be0af61384676debe14411eb508d0375cf1981c627078e7adb0c0480f9a13
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                sys-daemon.sh
                • Path /etc/profile.d/sys-daemon.sh
                • Size 32B
                • SHA256 1a23e3aca8bd09d7510879fb33ebaf2c8c5a3aa63e4e6bb945a82e8ab60607ae
                • MD5 SHA1 SHA512
                Submit Download

                sys.service
                • Path /root/.config/systemd/user/sys.service
                • Size 131B
                • SHA256 896b63b1b4b2cbb7b8940f092135ff0137ff2ced796e6258e4bdcd197b42a5e7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                �
                • Path /tmp/�
                • Size 154B
                • SHA256 ea88a7eac03767cebbdf520be3c130a84640e812a016cad21f87db3737970c11
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                .l.so.0
                • Path /tmp/.l.so.0
                • Size 1B
                • SHA256 620bfdaa346b088fb49998d92f19a7eaf6bfc2fb0aee015753966da1028cb731
                • MD5 SHA1 SHA512
                Submit Download

                root
                • Path /var/spool/cron/crontabs/root
                • Size 39B
                • SHA256 ed959a629cf06d84a2e93e1968426c84d428009b5304c2eb071409bde68e75c7
                • MD5 SHA1 SHA512
                Submit Download

                .so
                • Path /var/tmp/.so
                • Size 1B
                • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
                • MD5 SHA1 SHA512
                Submit Download