Analysis
-
max time kernel
136s -
max time network
155s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
03-01-2025 17:49
Behavioral task
behavioral1
Sample
656-1-0x00008000-0x000236c8-memory.dmp
Resource
debian9-armhf-20240611-en
debian-9-armhf
4 signatures
150 seconds
General
-
Target
656-1-0x00008000-0x000236c8-memory.dmp
-
Size
96KB
-
MD5
856a4e1a439f69d16c1e1d60e7d3ed9c
-
SHA1
271ca8c48a403916ca1878a39720f482fe55099d
-
SHA256
0798112b08179aa8da810e484f5e12a55556043f3d7bc1cfe9b383b9e8d91c0a
-
SHA512
5aaf8d6510b8a6be70202861531051abcc6a15844417fdff66cb94845e9e1a50669c088eff4ed1e737d91aba2133b356b67e2d62afea0aaf328cee11b8de527f
-
SSDEEP
3072:e0jlwv74BRae/xGPZ06v/mYp+C9T6MjU5:e0jlwyRae/xGPd/z+cT6OU5
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 656-1-0x00008000-0x000236c8-memory.dmp File opened for modification /dev/misc/watchdog 656-1-0x00008000-0x000236c8-memory.dmp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /bin/watchdog 656-1-0x00008000-0x000236c8-memory.dmp File opened for modification /sbin/watchdog 656-1-0x00008000-0x000236c8-memory.dmp -
description ioc Process File opened for reading /proc/264/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/650/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/12/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/22/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/42/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/141/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/406/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/451/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/3/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/6/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/100/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/279/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/307/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/29/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/111/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/155/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/5/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/23/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/4/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/263/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/456/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/27/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/41/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/265/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/1/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/10/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/656/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/28/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/169/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/9/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/16/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/17/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/644/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/655/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/2/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/13/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/298/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/78/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/135/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/611/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/24/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/149/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/280/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/296/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/323/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/8/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/19/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/20/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/411/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/657/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/212/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/658/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/661/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/7/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/26/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/110/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/21/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/25/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/108/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/266/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/653/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/14/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/15/status 656-1-0x00008000-0x000236c8-memory.dmp File opened for reading /proc/18/status 656-1-0x00008000-0x000236c8-memory.dmp