Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
14/04/2025, 19:49
Behavioral task
behavioral1
Sample
702-1-0x00008000-0x00029794-memory.dmp
Resource
debian9-armhf-20240418-en
debian-9-armhf
5 signatures
150 seconds
General
-
Target
702-1-0x00008000-0x00029794-memory.dmp
-
Size
89KB
-
MD5
02df72634b0990f585526bd5e57192b7
-
SHA1
d16d1afed360148f8caa2cbec85a78d3dace60e9
-
SHA256
581808d5bbc01cadd2257915928dbc147ea1c783f71059e3f24763b09e476560
-
SHA512
673cd237f3d087f8f8b950570521c540bfabccebd5c5b8204646ab6ced15b1ddeb64dd2ce8a8244640ba07ce6197d910570d78c6fcc9578b02c798eee74283d3
-
SSDEEP
1536:6AnJr9LuyWmgddGe4XalHzbx8PKhEO9ljmi4NLCz7QHZeYHTvsT:3Vu+Ve4XalHzbx8PogNLCz7QHE8ET
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 645 702-1-0x00008000-0x00029794-memory.dmp -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 702-1-0x00008000-0x00029794-memory.dmp File opened for modification /dev/misc/watchdog 702-1-0x00008000-0x00029794-memory.dmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 176.135.161.184 -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself 0nvfmnvfpmerragvwjq1p3crkp0f 645 702-1-0x00008000-0x00029794-memory.dmp -
description ioc Process File opened for reading /proc/666624cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777�5cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/66664cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/3333�,cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/6666�3cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/6666 4cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777�5cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/6666�6cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/1111$cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777E6cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777M8cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/111c�"cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/6666�3cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777w5cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777�5cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/77779cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/6666�3cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/6666/stat 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777Q6cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/6666>4cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/3333�,cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/6666$4cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777C6cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/6666�6cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/1111�%cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/66666cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/2222/stat 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/6666 4cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777Q9cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777 6cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777G8cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/111�"cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/3333/stat 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/6666�4cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/6666�4cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777�4cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/666644cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777W9cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/111c�"cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/6666�3cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/55/stat 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777�7cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/222/stat 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/77775cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/222i�"cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/22228)cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/66663cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777=7cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777�7cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777�5cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/77774cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/66cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/2222�*cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/66664cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777@5cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/33/stat 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/6666�4cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/7777-6cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/77773cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/3333�3cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/11/stat 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/66664cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/222�"cmdline 702-1-0x00008000-0x00029794-memory.dmp File opened for reading /proc/6666�2cmdline 702-1-0x00008000-0x00029794-memory.dmp