Analysis
-
max time kernel
0s -
max time network
12s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
27-12-2024 05:17
Behavioral task
behavioral1
Sample
638-1-0x00008000-0x0002de68-memory.dmp
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
638-1-0x00008000-0x0002de68-memory.dmp
-
Size
106KB
-
MD5
55c316ea34f338e59b855dd975780500
-
SHA1
9aa52f5a0b920be157fb353b719ac2bf60154a99
-
SHA256
532d5474e65ff58d6196eda907ffe22e378a2647ffe5bbdbf907d3b938317aac
-
SHA512
d4574fcf5897795bbb5fbf3b7ecd09400b6e5ffbda3d5c0796c79f7aa70a1bf7024feb7875244b2e16c594da865ee4dd2bc7206e5a1eeb6d7d4718b6aa929f14
-
SSDEEP
3072:bUvDiabnHsGC3AalhgyCT6097HjvNMI41Md:bUvmabH4AalhgyCOo3N6Md
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 638-1-0x00008000-0x0002de68-memory.dmp File opened for modification /dev/misc/watchdog 638-1-0x00008000-0x0002de68-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/98/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/266/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/312/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/645/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/649/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/145/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/267/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/287/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/1/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/11/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/108/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/5/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/15/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/27/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/212/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/593/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/6/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/7/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/14/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/9/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/41/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/632/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/300/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/303/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/599/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/639/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/12/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/28/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/271/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/43/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/23/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/137/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/138/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/149/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/644/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/4/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/17/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/21/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/647/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/13/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/76/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/641/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/42/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/598/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/638/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/650/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/2/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/19/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/20/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/643/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/3/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/8/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/25/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/596/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/10/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/16/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/24/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/326/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/578/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/18/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/22/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/105/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/26/cmdline 638-1-0x00008000-0x0002de68-memory.dmp File opened for reading /proc/147/cmdline 638-1-0x00008000-0x0002de68-memory.dmp