Analysis
-
max time kernel
0s -
max time network
2s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
29-12-2024 02:34
Behavioral task
behavioral1
Sample
a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf
Resource
debian9-armhf-20240418-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf
-
Size
83KB
-
MD5
805711447838f98416cca520f3f10800
-
SHA1
0c91fdfd84cb40128e4ee25b2af26cd64344e4ce
-
SHA256
a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a
-
SHA512
90cdedc7b3957e04080247eb94cccb606db6406dc14ae75f3109c2a25c5c666ea8939f9aa36fc06937626041bd0e710d72dc7cb8512943079b31affb9616d435
-
SSDEEP
1536:SpB2MuSQpjYeO2ld8EFiHXzGrrclTdJmyq+lxWHPzY51l61d6KI:SpGSEYeO2ldFw3TrmyDxWvzY41I
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for modification /dev/misc/watchdog a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/12/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/13/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/19/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/24/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/6/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/7/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/9/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/11/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/629/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/27/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/205/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/260/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/571/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/1/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/4/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/26/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/43/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/303/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/632/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/8/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/75/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/138/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/152/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/259/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/640/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/641/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/3/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/10/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/14/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/15/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/636/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/17/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/22/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/28/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/592/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/29/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/104/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/23/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/41/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/309/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/630/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/16/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/97/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/106/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/635/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/167/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/265/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/305/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/589/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/5/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/2/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/262/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/591/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/42/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/149/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/256/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/623/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/638/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/18/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/21/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/141/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/586/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/25/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf File opened for reading /proc/107/cmdline a0e64f441429f1f80da8285856c1008f1a1ed4d236653b679b3f77e60fd25a0a.elf