Analysis
- max time kernel
149s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
- submitted
24/10/2026, 10:19
General
- Target leviathan.arm6.elf
- Size 145KB
- Sample261024-mcjmyshs6s
- SHA256 30565cd88df5581d1ecb807c7893702baf9489149bc255e72138819a4858c50e
Score
9/10
Malware Config
Signatures
- Contacts a large (185794) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
- Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
- Reads runtime system information 14 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/leviathan.arm6.elf/tmp/leviathan.arm6.elf1⤵
- Enumerates active TCP sockets
- Reads system routing table
- Reads system network configuration
- Reads runtime system information