Analysis
-
max time kernel
2s -
max time network
8s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
17-01-2025 04:48
Behavioral task
behavioral1
Sample
4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf
-
Size
83KB
-
MD5
1829a100f9c7b0564d194c315a7b5ac9
-
SHA1
d3bc9592bba4679ab0b98c16feb50e85ec9abe99
-
SHA256
4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a
-
SHA512
8a3f99b273935e65e9c2691f70212630bd450867be3fc48f5f1ae76d23bf1d6c98dcf7ed12ddd04921eb7688b5267b05b09643dd85f29e3b910cdfd75a99ba87
-
SSDEEP
1536:qpB2MuSQpjYeOeRdQEhuHXzirrIpjtTK2GyvqHPzY9Jl61d68I:qpGSEYeOeRdNkLjJK2Vqvzw4vI
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for modification /dev/misc/watchdog 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/2/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/5/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/9/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/24/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/645/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/14/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/29/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/106/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/654/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/4/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/11/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/22/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/109/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/272/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/1/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/653/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/18/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/260/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/419/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/3/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/8/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/23/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/27/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/43/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/26/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/96/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/273/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/659/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/6/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/41/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/136/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/140/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/290/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/652/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/656/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/10/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/17/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/151/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/258/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/270/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/21/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/42/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/169/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/291/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/197/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/644/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/648/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/650/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/658/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/463/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/15/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/20/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/146/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/16/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/76/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/406/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/12/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/13/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/19/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/25/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/28/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/300/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/464/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf File opened for reading /proc/608/cmdline 4fb97899f26e6715a1bb345de563a5379532e10f28b03df103a194f4c713988a.elf