Analysis
-
max time kernel
149s -
max time network
158s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
19-01-2025 14:17
Behavioral task
behavioral1
Sample
hold.arm5.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
hold.arm5.elf
-
Size
73KB
-
MD5
dbbfc41101d281284181405fb3bda5f4
-
SHA1
02a937721a417d37ca224a2a442eb66f69b423a1
-
SHA256
c37ed482dc4f51a198ebec5cbce5ccb03a7d591a108f5f6e3b3c96a388661314
-
SHA512
f99d0c13a37577d977ddca337f869e8ab146b56e1fbb232ef33404434619b32f66b32dc70ce524f9eb6c4b0c8054171068b54b3ed201e698e028a30d0cdfd689
-
SSDEEP
1536:xsvvmvVQbZ+vtxeGdZsmWVMN7x7WrFnqbO3nbf1xP+OUO:xsvvFzoZsmWVMWnq2j103O
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 657 hold.arm5.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog hold.arm5.elf File opened for modification /dev/misc/watchdog hold.arm5.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog hold.arm5.elf File opened for modification /bin/watchdog hold.arm5.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself lt83p8t1um0lck5m 657 hold.arm5.elf -
description ioc Process File opened for reading /proc/11/cmdline hold.arm5.elf File opened for reading /proc/269/cmdline hold.arm5.elf File opened for reading /proc/656/cmdline hold.arm5.elf File opened for reading /proc/669/cmdline hold.arm5.elf File opened for reading /proc/739/cmdline hold.arm5.elf File opened for reading /proc/4/cmdline hold.arm5.elf File opened for reading /proc/5/cmdline hold.arm5.elf File opened for reading /proc/8/cmdline hold.arm5.elf File opened for reading /proc/24/cmdline hold.arm5.elf File opened for reading /proc/284/cmdline hold.arm5.elf File opened for reading /proc/713/cmdline hold.arm5.elf File opened for reading /proc/735/cmdline hold.arm5.elf File opened for reading /proc/741/cmdline hold.arm5.elf File opened for reading /proc/9/cmdline hold.arm5.elf File opened for reading /proc/166/cmdline hold.arm5.elf File opened for reading /proc/599/cmdline hold.arm5.elf File opened for reading /proc/655/cmdline hold.arm5.elf File opened for reading /proc/683/cmdline hold.arm5.elf File opened for reading /proc/305/cmdline hold.arm5.elf File opened for reading /proc/670/cmdline hold.arm5.elf File opened for reading /proc/673/cmdline hold.arm5.elf File opened for reading /proc/725/cmdline hold.arm5.elf File opened for reading /proc/110/cmdline hold.arm5.elf File opened for reading /proc/149/cmdline hold.arm5.elf File opened for reading /proc/652/cmdline hold.arm5.elf File opened for reading /proc/744/cmdline hold.arm5.elf File opened for reading /proc/749/cmdline hold.arm5.elf File opened for reading /proc/681/cmdline hold.arm5.elf File opened for reading /proc/707/cmdline hold.arm5.elf File opened for reading /proc/723/cmdline hold.arm5.elf File opened for reading /proc/729/cmdline hold.arm5.elf File opened for reading /proc/28/cmdline hold.arm5.elf File opened for reading /proc/668/cmdline hold.arm5.elf File opened for reading /proc/682/cmdline hold.arm5.elf File opened for reading /proc/722/cmdline hold.arm5.elf File opened for reading /proc/687/cmdline hold.arm5.elf File opened for reading /proc/699/cmdline hold.arm5.elf File opened for reading /proc/751/cmdline hold.arm5.elf File opened for reading /proc/2/cmdline hold.arm5.elf File opened for reading /proc/76/cmdline hold.arm5.elf File opened for reading /proc/107/cmdline hold.arm5.elf File opened for reading /proc/306/cmdline hold.arm5.elf File opened for reading /proc/600/cmdline hold.arm5.elf File opened for reading /proc/728/cmdline hold.arm5.elf File opened for reading /proc/596/cmdline hold.arm5.elf File opened for reading /proc/606/cmdline hold.arm5.elf File opened for reading /proc/693/cmdline hold.arm5.elf File opened for reading /proc/694/cmdline hold.arm5.elf File opened for reading /proc/703/cmdline hold.arm5.elf File opened for reading /proc/672/cmdline hold.arm5.elf File opened for reading /proc/688/cmdline hold.arm5.elf File opened for reading /proc/715/cmdline hold.arm5.elf File opened for reading /proc/736/cmdline hold.arm5.elf File opened for reading /proc/13/cmdline hold.arm5.elf File opened for reading /proc/666/cmdline hold.arm5.elf File opened for reading /proc/700/cmdline hold.arm5.elf File opened for reading /proc/667/cmdline hold.arm5.elf File opened for reading /proc/695/cmdline hold.arm5.elf File opened for reading /proc/701/cmdline hold.arm5.elf File opened for reading /proc/702/cmdline hold.arm5.elf File opened for reading /proc/724/cmdline hold.arm5.elf File opened for reading /proc/16/cmdline hold.arm5.elf File opened for reading /proc/333/cmdline hold.arm5.elf File opened for reading /proc/745/cmdline hold.arm5.elf