Analysis
-
max time kernel
150s -
max time network
150s -
platform
debian-12_armhf -
resource
debian12-armhf-20240729-en -
resource tags
arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
19/01/2025, 14:26
Behavioral task
behavioral1
Sample
hold.arm7.elf
Resource
debian12-armhf-20240729-en
debian-12-armhf
6 signatures
150 seconds
General
-
Target
hold.arm7.elf
-
Size
153KB
-
MD5
e4f7204d3431fb4bb48ab247f08505c5
-
SHA1
c824ea2861705f93410d157619690b1eb0a574ec
-
SHA256
cd72083d32d2efb6e016141e71b54d3ac540c6a9fd4979a88cb688aed7cee276
-
SHA512
891d0cd38615cbc8fde0e903343abe430a641cc05c49883b80d87e6c68e70eb8373e2e8b0b4d5e63ac24fd2f798d2425aad7751e80f4dc70c1002c2ba75e634e
-
SSDEEP
3072:MkwTyVP7jvOXB7ayLZhzXYhBLrAuS2NrGFWS4PRM/9UrPZ:MByVjKR7ayLZhzX8B+kGFWnpM/9UB
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 696 hold.arm7.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog hold.arm7.elf File opened for modification /dev/misc/watchdog hold.arm7.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog hold.arm7.elf File opened for modification /bin/watchdog hold.arm7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself mgti5swsea1vajbw 696 hold.arm7.elf -
description ioc Process File opened for reading /proc/17/cmdline hold.arm7.elf File opened for reading /proc/24/cmdline hold.arm7.elf File opened for reading /proc/56/cmdline hold.arm7.elf File opened for reading /proc/14/cmdline hold.arm7.elf File opened for reading /proc/16/cmdline hold.arm7.elf File opened for reading /proc/197/cmdline hold.arm7.elf File opened for reading /proc/325/cmdline hold.arm7.elf File opened for reading /proc/720/cmdline hold.arm7.elf File opened for reading /proc/723/cmdline hold.arm7.elf File opened for reading /proc/730/cmdline hold.arm7.elf File opened for reading /proc/7/cmdline hold.arm7.elf File opened for reading /proc/30/cmdline hold.arm7.elf File opened for reading /proc/33/cmdline hold.arm7.elf File opened for reading /proc/711/cmdline hold.arm7.elf File opened for reading /proc/713/cmdline hold.arm7.elf File opened for reading /proc/731/cmdline hold.arm7.elf File opened for reading /proc/740/cmdline hold.arm7.elf File opened for reading /proc/35/cmdline hold.arm7.elf File opened for reading /proc/57/cmdline hold.arm7.elf File opened for reading /proc/326/cmdline hold.arm7.elf File opened for reading /proc/714/cmdline hold.arm7.elf File opened for reading /proc/73/cmdline hold.arm7.elf File opened for reading /proc/716/cmdline hold.arm7.elf File opened for reading /proc/721/cmdline hold.arm7.elf File opened for reading /proc/3/cmdline hold.arm7.elf File opened for reading /proc/11/cmdline hold.arm7.elf File opened for reading /proc/705/cmdline hold.arm7.elf File opened for reading /proc/23/cmdline hold.arm7.elf File opened for reading /proc/738/cmdline hold.arm7.elf File opened for reading /proc/45/cmdline hold.arm7.elf File opened for reading /proc/675/cmdline hold.arm7.elf File opened for reading /proc/729/cmdline hold.arm7.elf File opened for reading /proc/698/cmdline hold.arm7.elf File opened for reading /proc/348/cmdline hold.arm7.elf File opened for reading /proc/658/cmdline hold.arm7.elf File opened for reading /proc/741/cmdline hold.arm7.elf File opened for reading /proc/12/cmdline hold.arm7.elf File opened for reading /proc/31/cmdline hold.arm7.elf File opened for reading /proc/277/cmdline hold.arm7.elf File opened for reading /proc/15/cmdline hold.arm7.elf File opened for reading /proc/27/cmdline hold.arm7.elf File opened for reading /proc/292/cmdline hold.arm7.elf File opened for reading /proc/2/cmdline hold.arm7.elf File opened for reading /proc/5/cmdline hold.arm7.elf File opened for reading /proc/639/cmdline hold.arm7.elf File opened for reading /proc/210/cmdline hold.arm7.elf File opened for reading /proc/697/cmdline hold.arm7.elf File opened for reading /proc/715/cmdline hold.arm7.elf File opened for reading /proc/722/cmdline hold.arm7.elf File opened for reading /proc/717/cmdline hold.arm7.elf File opened for reading /proc/737/cmdline hold.arm7.elf File opened for reading /proc/188/cmdline hold.arm7.elf File opened for reading /proc/688/cmdline hold.arm7.elf File opened for reading /proc/694/cmdline hold.arm7.elf File opened for reading /proc/727/cmdline hold.arm7.elf File opened for reading /proc/1/cmdline hold.arm7.elf File opened for reading /proc/344/cmdline hold.arm7.elf File opened for reading /proc/356/cmdline hold.arm7.elf File opened for reading /proc/640/cmdline hold.arm7.elf File opened for reading /proc/706/cmdline hold.arm7.elf File opened for reading /proc/718/cmdline hold.arm7.elf File opened for reading /proc/20/cmdline hold.arm7.elf File opened for reading /proc/6/cmdline hold.arm7.elf File opened for reading /proc/725/cmdline hold.arm7.elf