Analysis
-
max time kernel
0s -
max time network
12s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
17-01-2025 04:34
Behavioral task
behavioral1
Sample
26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf
-
Size
86KB
-
MD5
4ee22dcda4050eb75dff55530fe19743
-
SHA1
bf9da8ef99aaefb9da9d6f35de7349fba47d5bb7
-
SHA256
26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3
-
SHA512
65f6211a03e526caaaa88b1971c303c706b819f6ec695b603d7d9c020b6c0712835b4fdaa376f426ef54046593882c9011d840a87b7188be5dca072a9c9d117a
-
SSDEEP
1536:CdYcSX1jQq2aA93QjIlGVlwpRY7hvusiCfyVMwjLvVl61d68IXW+:CdjSXtQqlA9pY7hmsidqEV4vIXW
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for modification /dev/misc/watchdog 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/25/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/150/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/279/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/2/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/7/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/10/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/14/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/18/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/325/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/43/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/651/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/155/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/156/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/274/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/8/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/12/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/15/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/24/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/29/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/276/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/648/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/5/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/42/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/102/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/139/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/608/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/21/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/215/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/275/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/604/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/660/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/17/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/332/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/654/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/26/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/80/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/9/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/268/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/588/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/655/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/657/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/3/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/11/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/13/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/23/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/27/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/1/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/28/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/110/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/41/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/113/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/173/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/609/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/659/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/649/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/6/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/16/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/22/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/112/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/314/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/144/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/159/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/4/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf File opened for reading /proc/19/cmdline 26fa352495ea60edee171ec62e55c137b679249db19cdbb0ea6c2feee42a99e3.elf