Analysis
-
max time kernel
150s -
max time network
161s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
26-12-2024 09:12
Behavioral task
behavioral1
Sample
byte.arm.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
byte.arm.elf
-
Size
86KB
-
MD5
23107ac0d75474029f02a56394c28120
-
SHA1
9b7b5a2aa54769f0dab8ce3f4432985917b7d736
-
SHA256
930aabeaac6a9a8712d354cd4f75995f450fc53308b61d044e03228770dd34ff
-
SHA512
73b6c07047d9f585bee87ce2b4f691db2790dce58603e34eeb4fa69da63a1d955b080ce2297135ab6413af48cf3ba3cf83d268213bb77c43c6d37edea4d88f87
-
SSDEEP
1536:idYcSX1j4q2as9LQjIlaVlkhNY3FPzY2uBteVMwvLvRl61d6KIjW+:idjSXt4qls9xY3F7Y2uUqwR41IjW
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog byte.arm.elf File opened for modification /dev/misc/watchdog byte.arm.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/190/cmdline byte.arm.elf File opened for reading /proc/665/cmdline byte.arm.elf File opened for reading /proc/731/cmdline byte.arm.elf File opened for reading /proc/755/cmdline byte.arm.elf File opened for reading /proc/711/cmdline byte.arm.elf File opened for reading /proc/745/cmdline byte.arm.elf File opened for reading /proc/4/cmdline byte.arm.elf File opened for reading /proc/585/cmdline byte.arm.elf File opened for reading /proc/676/cmdline byte.arm.elf File opened for reading /proc/704/cmdline byte.arm.elf File opened for reading /proc/10/cmdline byte.arm.elf File opened for reading /proc/645/cmdline byte.arm.elf File opened for reading /proc/650/cmdline byte.arm.elf File opened for reading /proc/664/cmdline byte.arm.elf File opened for reading /proc/752/cmdline byte.arm.elf File opened for reading /proc/756/cmdline byte.arm.elf File opened for reading /proc/682/cmdline byte.arm.elf File opened for reading /proc/709/cmdline byte.arm.elf File opened for reading /proc/714/cmdline byte.arm.elf File opened for reading /proc/728/cmdline byte.arm.elf File opened for reading /proc/24/cmdline byte.arm.elf File opened for reading /proc/691/cmdline byte.arm.elf File opened for reading /proc/733/cmdline byte.arm.elf File opened for reading /proc/734/cmdline byte.arm.elf File opened for reading /proc/2/cmdline byte.arm.elf File opened for reading /proc/20/cmdline byte.arm.elf File opened for reading /proc/29/cmdline byte.arm.elf File opened for reading /proc/311/cmdline byte.arm.elf File opened for reading /proc/156/cmdline byte.arm.elf File opened for reading /proc/277/cmdline byte.arm.elf File opened for reading /proc/757/cmdline byte.arm.elf File opened for reading /proc/335/cmdline byte.arm.elf File opened for reading /proc/605/cmdline byte.arm.elf File opened for reading /proc/741/cmdline byte.arm.elf File opened for reading /proc/651/cmdline byte.arm.elf File opened for reading /proc/28/cmdline byte.arm.elf File opened for reading /proc/175/cmdline byte.arm.elf File opened for reading /proc/265/cmdline byte.arm.elf File opened for reading /proc/603/cmdline byte.arm.elf File opened for reading /proc/145/cmdline byte.arm.elf File opened for reading /proc/730/cmdline byte.arm.elf File opened for reading /proc/753/cmdline byte.arm.elf File opened for reading /proc/677/cmdline byte.arm.elf File opened for reading /proc/724/cmdline byte.arm.elf File opened for reading /proc/736/cmdline byte.arm.elf File opened for reading /proc/678/cmdline byte.arm.elf File opened for reading /proc/721/cmdline byte.arm.elf File opened for reading /proc/7/cmdline byte.arm.elf File opened for reading /proc/16/cmdline byte.arm.elf File opened for reading /proc/648/cmdline byte.arm.elf File opened for reading /proc/656/cmdline byte.arm.elf File opened for reading /proc/19/cmdline byte.arm.elf File opened for reading /proc/722/cmdline byte.arm.elf File opened for reading /proc/751/cmdline byte.arm.elf File opened for reading /proc/21/cmdline byte.arm.elf File opened for reading /proc/42/cmdline byte.arm.elf File opened for reading /proc/151/cmdline byte.arm.elf File opened for reading /proc/661/cmdline byte.arm.elf File opened for reading /proc/742/cmdline byte.arm.elf File opened for reading /proc/598/cmdline byte.arm.elf File opened for reading /proc/690/cmdline byte.arm.elf File opened for reading /proc/729/cmdline byte.arm.elf File opened for reading /proc/740/cmdline byte.arm.elf File opened for reading /proc/654/cmdline byte.arm.elf