Analysis
-
max time kernel
0s -
platform
debian-9_armhf -
resource
debian9-armhf-20250410-en -
resource tags
arch:armhfimage:debian9-armhf-20250410-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
15/04/2025, 01:00
Behavioral task
behavioral1
Sample
2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf
Resource
debian9-armhf-20250410-en
debian-9-armhf
4 signatures
150 seconds
General
-
Target
2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf
-
Size
50KB
-
MD5
0cfb71155d5e577a5d73f0cc28ec3790
-
SHA1
e7dc00dec4e5b1b18a697c777dd369b7436a64b7
-
SHA256
2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa
-
SHA512
cccf5a69317d390da96ebbc7d4de4ff8a3bd22ac2c8083853273ce5a655cc36b90fcc50a144b49a6f678d1e5a9e595ef01b0ddb6aaab57b5d7d5c4209980901a
-
SSDEEP
768:zBiYJuDr9yDm0xeECZuyP+8C8gqsojeFughQ/hbjBoRNsms4d48g:kY0DyCZPW8C87qFu0Q5bjBovH
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for modification /dev/misc/watchdog 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf -
Renames itself 1 IoCs
pid Process 654 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/10/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/25/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/26/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/103/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/148/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/301/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/16/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/29/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/114/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/11/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/143/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/272/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/274/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/604/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/9/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/12/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/18/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/174/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/652/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/140/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/286/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/325/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/19/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/111/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/288/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/593/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/7/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/15/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/22/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/24/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/28/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/43/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/17/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/27/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/41/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/42/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/113/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/159/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/209/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/603/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/641/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/21/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/314/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/597/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/649/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/654/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/3/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/8/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/81/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/311/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/4/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/647/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/648/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/653/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/2/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/5/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/6/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/13/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/285/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/302/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/14/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/275/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/580/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf File opened for reading /proc/651/comm 2032e0f3a514a0517179fd64c3e15bb7c19cfb68ea7b35534ffcf73d031dcdfa.elf