Analysis
-
max time kernel
0s -
max time network
2s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
17-01-2025 07:03
Behavioral task
behavioral1
Sample
f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf
Resource
debian9-armhf-20240729-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf
-
Size
86KB
-
MD5
ee175653fa4eebfd3ab4ece63fb0e0f4
-
SHA1
f12d031c0d68e8f390babd2b30903d0bc3020f3d
-
SHA256
f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9
-
SHA512
908d7f554a7a1df883e8fcbb35957d5d3b87743eb9d1f4b6700fedb2b6277c856e27a375714f3974338658c0f388ebe4f5a163d551f8204408eb91d17b9a1384
-
SSDEEP
1536:CdYcSX1jQq2aA93QjIlGVlwpRYbhvusiCfyVMwjLvVl61d68IXW+:CdjSXtQqlA9pYbhmsidqEV4vIXW
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for modification /dev/misc/watchdog f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/602/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/6/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/26/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/174/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/9/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/115/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/21/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/144/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/304/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/656/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/3/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/10/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/16/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/650/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/28/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/43/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/645/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/313/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/653/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/285/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/287/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/651/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/2/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/271/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/303/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/586/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/649/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/152/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/154/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/606/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/647/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/13/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/25/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/148/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/314/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/638/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/644/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/4/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/12/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/14/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/112/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/286/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/5/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/24/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/27/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/337/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/11/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/15/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/82/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/42/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/114/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/219/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/22/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/23/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/29/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/283/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/17/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/18/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/104/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/8/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/600/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/607/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/20/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf File opened for reading /proc/41/cmdline f945eed9fb7d1449e69e17404b58b4d2e340ae0efa145c1e4723d4dd9761e0c9.elf