Analysis
-
max time kernel
150s -
max time network
157s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
07/03/2025, 12:11
Behavioral task
behavioral1
Sample
zerarm7.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
6 signatures
150 seconds
General
-
Target
zerarm7.elf
-
Size
72KB
-
MD5
eaabc7aad745c2d680ea6bfc9444abbb
-
SHA1
c1823744d9b6d8ebc3e268b769761816a3b7e707
-
SHA256
912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c
-
SHA512
371cb11d0555fe0ef01e36bc6fa798cc3526a4c813a64203651d3a6aa272d2146ab2823dcbff479b5a8dc413865d586d9f3f3919ce05fe51c5cce69621f81d98
-
SSDEEP
1536:tdn6SsyWpUI66PvdMg3+rh5z1OZtBlDwwOLtwyGn9a9luOZciYvxLr:ZsyWUgvdMA+947BlDwwOLtwyGLu+vxn
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog zerarm7.elf File opened for modification /dev/misc/watchdog zerarm7.elf -
Renames itself 1 IoCs
pid Process 708 zerarm7.elf -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 194.36.144.87 Destination IP 202.61.197.122 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself exim4 708 zerarm7.elf -
description ioc Process File opened for reading /proc/9/comm zerarm7.elf File opened for reading /proc/25/comm zerarm7.elf File opened for reading /proc/33/comm zerarm7.elf File opened for reading /proc/308/comm zerarm7.elf File opened for reading /proc/666/comm zerarm7.elf File opened for reading /proc/46/comm zerarm7.elf File opened for reading /proc/247/comm zerarm7.elf File opened for reading /proc/352/comm zerarm7.elf File opened for reading /proc/58/comm zerarm7.elf File opened for reading /proc/26/comm zerarm7.elf File opened for reading /proc/7/comm zerarm7.elf File opened for reading /proc/21/comm zerarm7.elf File opened for reading /proc/36/comm zerarm7.elf File opened for reading /proc/3/comm zerarm7.elf File opened for reading /proc/19/comm zerarm7.elf File opened for reading /proc/45/comm zerarm7.elf File opened for reading /proc/144/comm zerarm7.elf File opened for reading /proc/707/comm zerarm7.elf File opened for reading /proc/29/comm zerarm7.elf File opened for reading /proc/38/comm zerarm7.elf File opened for reading /proc/341/comm zerarm7.elf File opened for reading /proc/583/comm zerarm7.elf File opened for reading /proc/8/comm zerarm7.elf File opened for reading /proc/15/comm zerarm7.elf File opened for reading /proc/34/comm zerarm7.elf File opened for reading /proc/305/comm zerarm7.elf File opened for reading /proc/687/comm zerarm7.elf File opened for reading /proc/706/comm zerarm7.elf File opened for reading /proc/708/comm zerarm7.elf File opened for reading /proc/1/comm zerarm7.elf File opened for reading /proc/20/comm zerarm7.elf File opened for reading /proc/310/comm zerarm7.elf File opened for reading /proc/6/comm zerarm7.elf File opened for reading /proc/32/comm zerarm7.elf File opened for reading /proc/221/comm zerarm7.elf File opened for reading /proc/43/comm zerarm7.elf File opened for reading /proc/52/comm zerarm7.elf File opened for reading /proc/143/comm zerarm7.elf File opened for reading /proc/316/comm zerarm7.elf File opened for reading /proc/23/comm zerarm7.elf File opened for reading /proc/12/comm zerarm7.elf File opened for reading /proc/16/comm zerarm7.elf File opened for reading /proc/17/comm zerarm7.elf File opened for reading /proc/30/comm zerarm7.elf File opened for reading /proc/5/comm zerarm7.elf File opened for reading /proc/18/comm zerarm7.elf File opened for reading /proc/24/comm zerarm7.elf File opened for reading /proc/31/comm zerarm7.elf File opened for reading /proc/35/comm zerarm7.elf File opened for reading /proc/47/comm zerarm7.elf File opened for reading /proc/207/comm zerarm7.elf File opened for reading /proc/22/comm zerarm7.elf File opened for reading /proc/27/comm zerarm7.elf File opened for reading /proc/450/comm zerarm7.elf File opened for reading /proc/684/comm zerarm7.elf File opened for reading /proc/701/comm zerarm7.elf File opened for reading /proc/2/comm zerarm7.elf File opened for reading /proc/13/comm zerarm7.elf File opened for reading /proc/74/comm zerarm7.elf File opened for reading /proc/318/comm zerarm7.elf File opened for reading /proc/337/comm zerarm7.elf File opened for reading /proc/579/comm zerarm7.elf File opened for reading /proc/683/comm zerarm7.elf File opened for reading /proc/705/comm zerarm7.elf