Analysis
- max time kernel
61s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
- submitted
24/10/2026, 10:19
General
- Target leviathan.arm7.elf
- Size 182KB
- Sample261024-mch2eshs51
- SHA256 7bf253e88bbded37d52cb3fd627dcbcd69b570a45e2b3fdda7c2fff168cde408
Score
9/10
Malware Config
Signatures
- Contacts a large (184122) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
- Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
- Reads runtime system information 14 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/leviathan.arm7.elf/tmp/leviathan.arm7.elf1⤵
- Enumerates active TCP sockets
- Reads system routing table
- Reads system network configuration
- Reads runtime system information