4c925b9ea4ab9a227fc0149febd952595eb85e140ebf80b33463aeabac85f45d

Analysis

max time kernel
124s
max time network
127s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
18/02/2025, 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

arm61.elf
Size

174KB
MD5

cc47f647effcbdc799eac084793fe2b6
SHA1

41bff1e23f49118dba938bf0830b06270417a131
SHA256

4c925b9ea4ab9a227fc0149febd952595eb85e140ebf80b33463aeabac85f45d
SHA512

8f8b709e1571c1de040eb6af0b61ed87222a484d454a967a7b84319d34575ae282c95646f9244fb28550580231741e4cac751f4163e646926cf29a22bca44027
SSDEEP

3072:wuadAFdMTaMirPVDoUSXd7f+5C+OwfkmexV7t5OGNmGwxM8QURH:w3AwTaMirP9ol1f+s+Ow8lxV7SGNmGwV

Score

7^/10

defense_evasion

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	arm61.elf
File opened for modification	/dev/misc/watchdog	arm61.elf

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	649	arm61.elf

/tmp/arm61.elf
/tmp/arm61.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
PID:649

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...