Analysis
-
max time kernel
149s -
max time network
149s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
16-01-2025 05:27
Behavioral task
behavioral1
Sample
byte.arm.elf
Resource
debian9-armhf-20240418-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
byte.arm.elf
-
Size
86KB
-
MD5
ee175653fa4eebfd3ab4ece63fb0e0f4
-
SHA1
f12d031c0d68e8f390babd2b30903d0bc3020f3d
-
SHA256
f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9
-
SHA512
908d7f554a7a1df883e8fcbb35957d5d3b87743eb9d1f4b6700fedb2b6277c856e27a375714f3974338658c0f388ebe4f5a163d551f8204408eb91d17b9a1384
-
SSDEEP
1536:CdYcSX1jQq2aA93QjIlGVlwpRYbhvusiCfyVMwjLvVl61d68IXW+:CdjSXtQqlA9pYbhmsidqEV4vIXW
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog byte.arm.elf File opened for modification /dev/misc/watchdog byte.arm.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/718/cmdline byte.arm.elf File opened for reading /proc/724/cmdline byte.arm.elf File opened for reading /proc/3/cmdline byte.arm.elf File opened for reading /proc/23/cmdline byte.arm.elf File opened for reading /proc/646/cmdline byte.arm.elf File opened for reading /proc/651/cmdline byte.arm.elf File opened for reading /proc/266/cmdline byte.arm.elf File opened for reading /proc/629/cmdline byte.arm.elf File opened for reading /proc/693/cmdline byte.arm.elf File opened for reading /proc/1/cmdline byte.arm.elf File opened for reading /proc/5/cmdline byte.arm.elf File opened for reading /proc/8/cmdline byte.arm.elf File opened for reading /proc/218/cmdline byte.arm.elf File opened for reading /proc/713/cmdline byte.arm.elf File opened for reading /proc/719/cmdline byte.arm.elf File opened for reading /proc/25/cmdline byte.arm.elf File opened for reading /proc/26/cmdline byte.arm.elf File opened for reading /proc/660/cmdline byte.arm.elf File opened for reading /proc/666/cmdline byte.arm.elf File opened for reading /proc/735/cmdline byte.arm.elf File opened for reading /proc/9/cmdline byte.arm.elf File opened for reading /proc/41/cmdline byte.arm.elf File opened for reading /proc/96/cmdline byte.arm.elf File opened for reading /proc/697/cmdline byte.arm.elf File opened for reading /proc/278/cmdline byte.arm.elf File opened for reading /proc/304/cmdline byte.arm.elf File opened for reading /proc/636/cmdline byte.arm.elf File opened for reading /proc/638/cmdline byte.arm.elf File opened for reading /proc/19/cmdline byte.arm.elf File opened for reading /proc/42/cmdline byte.arm.elf File opened for reading /proc/630/cmdline byte.arm.elf File opened for reading /proc/4/cmdline byte.arm.elf File opened for reading /proc/105/cmdline byte.arm.elf File opened for reading /proc/275/cmdline byte.arm.elf File opened for reading /proc/29/cmdline byte.arm.elf File opened for reading /proc/654/cmdline byte.arm.elf File opened for reading /proc/686/cmdline byte.arm.elf File opened for reading /proc/2/cmdline byte.arm.elf File opened for reading /proc/13/cmdline byte.arm.elf File opened for reading /proc/18/cmdline byte.arm.elf File opened for reading /proc/22/cmdline byte.arm.elf File opened for reading /proc/635/cmdline byte.arm.elf File opened for reading /proc/707/cmdline byte.arm.elf File opened for reading /proc/728/cmdline byte.arm.elf File opened for reading /proc/739/cmdline byte.arm.elf File opened for reading /proc/12/cmdline byte.arm.elf File opened for reading /proc/21/cmdline byte.arm.elf File opened for reading /proc/24/cmdline byte.arm.elf File opened for reading /proc/588/cmdline byte.arm.elf File opened for reading /proc/300/cmdline byte.arm.elf File opened for reading /proc/650/cmdline byte.arm.elf File opened for reading /proc/665/cmdline byte.arm.elf File opened for reading /proc/680/cmdline byte.arm.elf File opened for reading /proc/720/cmdline byte.arm.elf File opened for reading /proc/721/cmdline byte.arm.elf File opened for reading /proc/280/cmdline byte.arm.elf File opened for reading /proc/641/cmdline byte.arm.elf File opened for reading /proc/734/cmdline byte.arm.elf File opened for reading /proc/276/cmdline byte.arm.elf File opened for reading /proc/671/cmdline byte.arm.elf File opened for reading /proc/701/cmdline byte.arm.elf File opened for reading /proc/107/cmdline byte.arm.elf File opened for reading /proc/312/cmdline byte.arm.elf File opened for reading /proc/589/cmdline byte.arm.elf