Analysis
- max time kernel
145s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20250619-en - resource tags
arch:armhfimage:debian12-armhf-20250619-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
28/10/2025, 04:31
Behavioral task
behavioral1
Sample
Orbt.arm7.elf
Resource
debian12-armhf-20250619-en
debian-12-armhf
6 signatures
150 seconds
General
- Target Orbt.arm7.elf
- Size 87KB
- Sample251028-e5dy6scv5c
- SHA256 4f7ea3e11393cbe8863cadbcbdeabde5a091dba32cdb22bd8ef3bdf3c2b615b2
- MD5 8d103c020b82d051eff5c9615c1edc05
- SHA1 f3ab64b18a8446d7160192c1ac88f66f527c5276
- SHA512 fa2d8026a92478e9adadfd9b0ac2e0857e64e884b5d27d891da90711790b4a536967788f609b42ff2ceb045b1e138e7919a8d58c15da6b266eb82f03f32d1a89
- SSDEEP 1536:2IAkQKOYAYyc22k90IgrRmQjP9zZvbLiaLKON/YIgVs:2IAxKOYTyAkCBcQz9dJLN9YIgVs
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
mirailoversddos.duckdns.org
Signatures
- Mirai family
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Orbt.arm7.elf File opened for modification /dev/misc/watchdog Orbt.arm7.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Orbt.arm7.elf File opened for modification /bin/watchdog Orbt.arm7.elf -
description ioc Process File opened for reading /proc/46/status Orbt.arm7.elf File opened for reading /proc/143/status Orbt.arm7.elf File opened for reading /proc/732/status Orbt.arm7.elf File opened for reading /proc/self/exe Orbt.arm7.elf File opened for reading /proc/6/status Orbt.arm7.elf File opened for reading /proc/19/status Orbt.arm7.elf File opened for reading /proc/32/status Orbt.arm7.elf File opened for reading /proc/198/status Orbt.arm7.elf File opened for reading /proc/208/status Orbt.arm7.elf File opened for reading /proc/3/status Orbt.arm7.elf File opened for reading /proc/11/status Orbt.arm7.elf File opened for reading /proc/14/status Orbt.arm7.elf File opened for reading /proc/24/status Orbt.arm7.elf File opened for reading /proc/31/status Orbt.arm7.elf File opened for reading /proc/193/status Orbt.arm7.elf File opened for reading /proc/623/status Orbt.arm7.elf File opened for reading /proc/671/status Orbt.arm7.elf File opened for reading /proc/13/status Orbt.arm7.elf File opened for reading /proc/16/status Orbt.arm7.elf File opened for reading /proc/17/status Orbt.arm7.elf File opened for reading /proc/20/status Orbt.arm7.elf File opened for reading /proc/35/status Orbt.arm7.elf File opened for reading /proc/73/status Orbt.arm7.elf File opened for reading /proc/218/status Orbt.arm7.elf File opened for reading /proc/776/status Orbt.arm7.elf File opened for reading /proc/27/status Orbt.arm7.elf File opened for reading /proc/28/status Orbt.arm7.elf File opened for reading /proc/30/status Orbt.arm7.elf File opened for reading /proc/42/status Orbt.arm7.elf File opened for reading /proc/56/status Orbt.arm7.elf File opened for reading /proc/4/status Orbt.arm7.elf File opened for reading /proc/29/status Orbt.arm7.elf File opened for reading /proc/36/status Orbt.arm7.elf File opened for reading /proc/353/status Orbt.arm7.elf File opened for reading /proc/728/status Orbt.arm7.elf File opened for reading /proc/2/status Orbt.arm7.elf File opened for reading /proc/25/status Orbt.arm7.elf File opened for reading /proc/33/status Orbt.arm7.elf File opened for reading /proc/640/status Orbt.arm7.elf File opened for reading /proc/783/status Orbt.arm7.elf File opened for reading /proc/786/status Orbt.arm7.elf File opened for reading /proc/18/status Orbt.arm7.elf File opened for reading /proc/641/status Orbt.arm7.elf File opened for reading /proc/729/status Orbt.arm7.elf File opened for reading /proc/761/status Orbt.arm7.elf File opened for reading /proc/777/status Orbt.arm7.elf File opened for reading /proc/372/status Orbt.arm7.elf File opened for reading /proc/678/status Orbt.arm7.elf File opened for reading /proc/781/status Orbt.arm7.elf File opened for reading /proc/315/status Orbt.arm7.elf File opened for reading /proc/338/status Orbt.arm7.elf File opened for reading /proc/8/status Orbt.arm7.elf File opened for reading /proc/23/status Orbt.arm7.elf File opened for reading /proc/57/status Orbt.arm7.elf File opened for reading /proc/142/status Orbt.arm7.elf File opened for reading /proc/316/status Orbt.arm7.elf File opened for reading /proc/333/status Orbt.arm7.elf File opened for reading /proc/1/status Orbt.arm7.elf File opened for reading /proc/10/status Orbt.arm7.elf File opened for reading /proc/12/status Orbt.arm7.elf File opened for reading /proc/15/status Orbt.arm7.elf File opened for reading /proc/21/status Orbt.arm7.elf File opened for reading /proc/246/status Orbt.arm7.elf File opened for reading /proc/342/status Orbt.arm7.elf