Overview

overview

7

Static

static

1

3.elf

debian-12-armhf

7

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    20/10/2026, 04:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3.elf
  • Size 597KB
  • Sample261020-e31edsvt2l
  • SHA256 66190998e6606df3b635ef7e4e1905f44a869bcce0458325abeb9f05cd02aed5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 4 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 2 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads MAC address of network interface 2 TTPs 2 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • Reads hardware information 1 TTPs 2 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Removes the immutable protection flag from a file 1 TTPs 7 IoCs

    Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

  • Write file to user bin folder 2 IoCs
    persistence
  • Changes its process name 1 IoCs
  • Reads CPU attributes 1 TTPs 1 IoCs
    discovery
  • Reads system network configuration 1 TTPs 2 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/3.elf
    /tmp/3.elf
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Modifies Watchdog functionality
    • Modifies systemd
    • Reads MAC address of network interface
    • Reads hardware information
    • Write file to user bin folder
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to shm directory
    PID:788
    • /usr/bin/chattr
      chattr -i /etc/.kblockd667
      2⤵
      • Removes the immutable protection flag from a file
      PID:802
    • /usr/bin/chattr
      chattr -i /var/cache/.kblockd667
      2⤵
      • Removes the immutable protection flag from a file
      PID:809
    • /usr/bin/chattr
      chattr -i /var/lib/.kblockd667
      2⤵
      • Removes the immutable protection flag from a file
      PID:810
    • /usr/bin/chattr
      chattr -i /usr/bin/.kblockd667
      2⤵
      • Removes the immutable protection flag from a file
      PID:811
    • /bin/systemctl
      systemctl daemon-reload
      2⤵
        PID:812
      • /bin/systemctl
        systemctl enable --now /etc/systemd/system/kblockd667.service
        2⤵
          PID:828
      • /bin/sh
        sh /etc/.kblockd667.loop
        1⤵
          PID:846
          • /usr/bin/date
            date "+%s"
            2⤵
              PID:847
            • /usr/bin/cat
              cat /etc/.kblockd667.beat
              2⤵
                PID:848
              • /usr/bin/sleep
                sleep 45
                2⤵
                  PID:849
                • /usr/bin/date
                  date "+%s"
                  2⤵
                    PID:891
                  • /usr/bin/cat
                    cat /etc/.kblockd667.beat
                    2⤵
                      PID:892
                    • /usr/bin/sleep
                      sleep 45
                      2⤵
                        PID:893
                      • /usr/bin/date
                        date "+%s"
                        2⤵
                          PID:894
                        • /usr/bin/cat
                          cat /etc/.kblockd667.beat
                          2⤵
                            PID:895
                          • /usr/bin/sleep
                            sleep 45
                            2⤵
                              PID:896
                          • /etc/.kblockd667
                            /etc/.kblockd667
                            1⤵
                            • Modifies Watchdog functionality
                            • Enumerates active TCP sockets
                            • Modifies systemd
                            • Reads MAC address of network interface
                            • Reads hardware information
                            • Write file to user bin folder
                            • Changes its process name
                            • Reads CPU attributes
                            • Reads system network configuration
                            • Enumerates kernel/hardware configuration
                            • Reads runtime system information
                            • Writes file to tmp directory
                            PID:788
                            • /usr/bin/chattr
                              chattr -i /var/cache/.kblockd667
                              2⤵
                              • Removes the immutable protection flag from a file
                              PID:850
                            • /usr/bin/chattr
                              chattr -i /var/lib/.kblockd667
                              2⤵
                              • Removes the immutable protection flag from a file
                              PID:851
                            • /usr/bin/chattr
                              chattr -i /usr/bin/.kblockd667
                              2⤵
                              • Removes the immutable protection flag from a file
                              PID:852
                            • /bin/systemctl
                              systemctl daemon-reload
                              2⤵
                                PID:853
                              • /bin/systemctl
                                systemctl enable --now /etc/systemd/system/kblockd667.service
                                2⤵
                                  PID:871

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    XDG Autostart Entries

                                    1
                                    T1547.013

                                    Create or Modify System Process

                                    1
                                    T1543

                                    Systemd Service

                                    1
                                    T1543.002

                                    Privilege Escalation

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    XDG Autostart Entries

                                    1
                                    T1547.013

                                    Create or Modify System Process

                                    1
                                    T1543

                                    Systemd Service

                                    1
                                    T1543.002

                                    Defense Evasion

                                    File and Directory Permissions Modification

                                    1
                                    T1222

                                    Linux and Mac File and Directory Permissions Modification

                                    1
                                    T1222.002

                                    Impair Defenses

                                    1
                                    T1562

                                    Credential Access

                                    Discovery

                                    System Information Discovery

                                    3
                                    T1082

                                    System Network Configuration Discovery

                                    2
                                    T1016

                                    Internet Connection Discovery

                                    1
                                    T1016.001

                                    Wi-Fi Discovery

                                    1
                                    T1016.002

                                    System Network Connections Discovery

                                    2
                                    T1049

                                    Lateral Movement

                                    Collection

                                    Command and Control

                                    Exfiltration

                                    Impact

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    .boat.lock
                                    • Path /dev/shm/.boat.lock
                                    • Size 4B
                                    • SHA256 2869386df9ad7e5318b484cd8f21dc8fda7fc267f2e926169f644a51e190f785
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    .kblockd667
                                    • Path /etc/.kblockd667
                                    • Size 597KB
                                    • SHA256 66190998e6606df3b635ef7e4e1905f44a869bcce0458325abeb9f05cd02aed5
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    .mine
                                    • Path /etc/.mine
                                    • Size 228B
                                    • SHA256 ecb9f0d2487757d48960ce5ede78b864cda3005b6bbc2b4fa1ab1455bb6cce0f
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    .mstat
                                    • Path /etc/.mstat
                                    • Size 112B
                                    • SHA256 94a5a0074ae1ead1fcc0c4ea26ef71573e42f5ce9cadee4e880fae9e58cfe165
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    kblockd667.service
                                    • Path /etc/systemd/system/kblockd667.service
                                    • Size 244B
                                    • SHA256 eaed0839513c6deaded544f9907722517208f87e263ea89d0e5476fc0316ccae
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download