Analysis
-
max time kernel
1s -
max time network
8s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
14-01-2025 02:45
Behavioral task
behavioral1
Sample
78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
3 signatures
150 seconds
General
-
Target
78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf
-
Size
164KB
-
MD5
3db319ee9c401bc1f3c8127b1a83d629
-
SHA1
0ab19f281369916d2a9b633c8d3db66baff89c55
-
SHA256
78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4
-
SHA512
5c98b97a3b8fa3b7f0df737ca05afab1e96729676f1207c725733103f3bcd4dff20a85a92cbb02489a3103fb77ad7ce441d5725f911f70497a1db51145f7db30
-
SSDEEP
3072:3UvDiabnHYGC3AalhgyCT6097HjvNMI41Mb+ewAM/9VYGbCo:3UvmabHsAalhgyCOo3N6Mb+eTM/9VYFo
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for modification /dev/misc/watchdog 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/15/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/268/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/357/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/4/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/25/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/58/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/9/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/13/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/704/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/1/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/347/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/641/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/684/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/2/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/18/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/22/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/24/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/33/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/36/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/43/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/143/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/323/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/26/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/343/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/681/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/8/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/14/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/30/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/301/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/478/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/20/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/27/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/144/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/324/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/486/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/706/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/28/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/31/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/45/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/46/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/57/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/201/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/336/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/344/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/10/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/11/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/16/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/17/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/32/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/202/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/350/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/648/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/680/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/703/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/708/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/3/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/666/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/698/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/7/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/47/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/5/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/6/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/12/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf File opened for reading /proc/21/cmdline 78e61c3de58f884934783dcccbef8b6738ea940d502410cddf70cc4f66f39cf4.elf