Analysis
-
max time kernel
150s -
max time network
152s -
platform
debian-12_armhf -
resource
debian12-armhf-20240729-en -
resource tags
arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
14/04/2025, 19:44
Behavioral task
behavioral1
Sample
parm7.elf
Resource
debian12-armhf-20240729-en
debian-12-armhf
6 signatures
150 seconds
General
-
Target
parm7.elf
-
Size
57KB
-
MD5
879d94931867f6e9995dbd791a5fbd2c
-
SHA1
ed92c124ed262c8cdd23dc9b61befdeab0bbe2e5
-
SHA256
d00cd2fe5bbe371d416c98a4f951bc8143ef701bab17e46a5ede39394dff83f3
-
SHA512
5d68941edf6eae2ab17d9d8b70c92036dd0429a4d37ef9e804460a2538295d3b00219348112bb8d375a66a5c2529951c0de9886f5706c166334aa668f8d46c1b
-
SSDEEP
1536:+PS4tGPvZTbcmT6mYK3m8JyxVLCYYH9rJ:+PltGHT6mYGmHLCYo9rJ
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
MIRAI
Signatures
-
Mirai family
-
Deletes itself 1 IoCs
pid Process 702 parm7.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog parm7.elf File opened for modification /dev/misc/watchdog parm7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself od8uq3pgfeh61ldv27j4b5nh 702 parm7.elf -
description ioc Process File opened for reading /proc/22/stat parm7.elf File opened for reading /proc/7777/;cmdline parm7.elf File opened for reading /proc/7777n;cmdline parm7.elf File opened for reading /proc/7777w;cmdline parm7.elf File opened for reading /proc/6666�:cmdline parm7.elf File opened for reading /proc/7777/stat parm7.elf File opened for reading /proc/7777[;cmdline parm7.elf File opened for reading /proc/7777h;cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/111v/cmdline parm7.elf File opened for reading /proc/7777Y;cmdline parm7.elf File opened for reading /proc/3333w5cmdline parm7.elf File opened for reading /proc/7777;cmdline parm7.elf File opened for reading /proc/33/stat parm7.elf File opened for reading /proc/2222/stat parm7.elf File opened for reading /proc/77775;cmdline parm7.elf File opened for reading /proc/7777b;cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/222�/cmdline parm7.elf File opened for reading /proc/1111 ;cmdline parm7.elf File opened for reading /proc/2222�3cmdline parm7.elf File opened for reading /proc/3333�4cmdline parm7.elf File opened for reading /proc/77771;cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/444d�/cmdline parm7.elf File opened for reading /proc/1111�/cmdline parm7.elf File opened for reading /proc/33335cmdline parm7.elf File opened for reading /proc/333s�/cmdline parm7.elf File opened for reading /proc/6666�:cmdline parm7.elf File opened for reading /proc/6666&;cmdline parm7.elf File opened for reading /proc/222/stat parm7.elf File opened for reading /proc/111c~/cmdline parm7.elf File opened for reading /proc/6666�7cmdline parm7.elf File opened for reading /proc/7777m;cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/111cmdline parm7.elf File opened for reading /proc/1111Z0cmdline parm7.elf File opened for reading /proc/1111U2cmdline parm7.elf File opened for reading /proc/3333%;cmdline parm7.elf File opened for reading /proc/6666';cmdline parm7.elf File opened for reading /proc/7777N;cmdline parm7.elf File opened for reading /proc/11cmdline parm7.elf File opened for reading /proc/111ut/cmdline parm7.elf File opened for reading /proc/7777@;cmdline parm7.elf File opened for reading /proc/7777R;cmdline parm7.elf File opened for reading /proc/66cmdline parm7.elf File opened for reading /proc/222�/cmdline parm7.elf File opened for reading /proc/7777L;cmdline parm7.elf File opened for reading /proc/7777o;cmdline parm7.elf File opened for reading /proc/222c�/cmdline parm7.elf File opened for reading /proc/111/stat parm7.elf File opened for reading /proc/7777P;cmdline parm7.elf File opened for reading /proc/333�/cmdline parm7.elf File opened for reading /proc/22cmdline parm7.elf File opened for reading /proc/3333fffffffcmdline parm7.elf File opened for reading /proc/44/stat parm7.elf File opened for reading /proc/77cmdline parm7.elf File opened for reading /proc/111l/cmdline parm7.elf File opened for reading /proc/333�/cmdline parm7.elf File opened for reading /proc/7777);cmdline parm7.elf File opened for reading /proc/99/stat parm7.elf File opened for reading /proc/7777K;cmdline parm7.elf File opened for reading /proc/7777U;cmdline parm7.elf File opened for reading /proc/7777/exe parm7.elf