Analysis
-
max time kernel
149s -
max time network
158s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
17-01-2025 02:27
Behavioral task
behavioral1
Sample
pecga.arm5.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
8 signatures
150 seconds
General
-
Target
pecga.arm5.elf
-
Size
37KB
-
MD5
ddc66dddc7b835d9bb2ae795a497bd7c
-
SHA1
50639e184610075bdd21518bc1ecab256b663955
-
SHA256
30482b8f60b505ad06cab6af1715dbd63f896de0b91e054cc08f3f8130a7c280
-
SHA512
aff3716036eee14c2cfa9f80f6ae32ced2f2cc070fe82608ab265f444c78a08349849e7f8450e4418b774bdb19d17bd618d7eb772176601db69e3dc2e338fa4a
-
SSDEEP
768:lteXEQb922QIlJii5z6PaJgIxRTDpLQj4/29GNEIX0l455SK/:lt0Hg2QIlki5zzrxRtQdGiI4MYK/
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
UNSTABLE
Signatures
-
Mirai family
-
Deletes itself 1 IoCs
pid Process 655 pecga.arm5.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog pecga.arm5.elf File opened for modification /dev/misc/watchdog pecga.arm5.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog pecga.arm5.elf File opened for modification /bin/watchdog pecga.arm5.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself n8o87mnlhwfa55om 655 pecga.arm5.elf -
description ioc Process File opened for reading /proc/6/cmdline pecga.arm5.elf File opened for reading /proc/123/cmdline pecga.arm5.elf File opened for reading /proc/154/cmdline pecga.arm5.elf File opened for reading /proc/700/cmdline pecga.arm5.elf File opened for reading /proc/705/cmdline pecga.arm5.elf File opened for reading /proc/724/cmdline pecga.arm5.elf File opened for reading /proc/668/cmdline pecga.arm5.elf File opened for reading /proc/680/cmdline pecga.arm5.elf File opened for reading /proc/713/cmdline pecga.arm5.elf File opened for reading /proc/677/cmdline pecga.arm5.elf File opened for reading /proc/709/cmdline pecga.arm5.elf File opened for reading /proc/710/cmdline pecga.arm5.elf File opened for reading /proc/728/cmdline pecga.arm5.elf File opened for reading /proc/13/cmdline pecga.arm5.elf File opened for reading /proc/666/cmdline pecga.arm5.elf File opened for reading /proc/706/cmdline pecga.arm5.elf File opened for reading /proc/721/cmdline pecga.arm5.elf File opened for reading /proc/15/cmdline pecga.arm5.elf File opened for reading /proc/18/cmdline pecga.arm5.elf File opened for reading /proc/750/cmdline pecga.arm5.elf File opened for reading /proc/605/cmdline pecga.arm5.elf File opened for reading /proc/607/cmdline pecga.arm5.elf File opened for reading /proc/641/cmdline pecga.arm5.elf File opened for reading /proc/660/cmdline pecga.arm5.elf File opened for reading /proc/671/cmdline pecga.arm5.elf File opened for reading /proc/693/cmdline pecga.arm5.elf File opened for reading /proc/746/cmdline pecga.arm5.elf File opened for reading /proc/9/cmdline pecga.arm5.elf File opened for reading /proc/43/cmdline pecga.arm5.elf File opened for reading /proc/663/cmdline pecga.arm5.elf File opened for reading /proc/675/cmdline pecga.arm5.elf File opened for reading /proc/715/cmdline pecga.arm5.elf File opened for reading /proc/719/cmdline pecga.arm5.elf File opened for reading /proc/733/cmdline pecga.arm5.elf File opened for reading /proc/738/cmdline pecga.arm5.elf File opened for reading /proc/27/cmdline pecga.arm5.elf File opened for reading /proc/90/cmdline pecga.arm5.elf File opened for reading /proc/652/cmdline pecga.arm5.elf File opened for reading /proc/664/cmdline pecga.arm5.elf File opened for reading /proc/670/cmdline pecga.arm5.elf File opened for reading /proc/676/cmdline pecga.arm5.elf File opened for reading /proc/735/cmdline pecga.arm5.elf File opened for reading /proc/5/cmdline pecga.arm5.elf File opened for reading /proc/608/cmdline pecga.arm5.elf File opened for reading /proc/648/cmdline pecga.arm5.elf File opened for reading /proc/4/cmdline pecga.arm5.elf File opened for reading /proc/28/cmdline pecga.arm5.elf File opened for reading /proc/42/cmdline pecga.arm5.elf File opened for reading /proc/291/cmdline pecga.arm5.elf File opened for reading /proc/311/cmdline pecga.arm5.elf File opened for reading /proc/701/cmdline pecga.arm5.elf File opened for reading /proc/718/cmdline pecga.arm5.elf File opened for reading /proc/294/cmdline pecga.arm5.elf File opened for reading /proc/679/cmdline pecga.arm5.elf File opened for reading /proc/722/cmdline pecga.arm5.elf File opened for reading /proc/41/cmdline pecga.arm5.elf File opened for reading /proc/161/cmdline pecga.arm5.elf File opened for reading /proc/667/cmdline pecga.arm5.elf File opened for reading /proc/754/cmdline pecga.arm5.elf File opened for reading /proc/699/cmdline pecga.arm5.elf File opened for reading /proc/745/cmdline pecga.arm5.elf File opened for reading /proc/751/cmdline pecga.arm5.elf File opened for reading /proc/310/cmdline pecga.arm5.elf File opened for reading /proc/654/cmdline pecga.arm5.elf