671b8430e5d809ec1505ddb4d2682fb5ab8f8a354ad58e0986f1c6c88ea26365

Analysis

max time kernel
147s
max time network
150s
platform
debian-12_armhf
resource
debian12-armhf-20250619-en
resource tags

arch:armhfimage:debian12-armhf-20250619-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
14/11/2025, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
671b8430e5d809ec1505ddb4d2682fb5ab8f8a354ad58e0986f1c6c88ea26365.bin
Size 109KB
Sample251114-sa8f7askgt
SHA256 671b8430e5d809ec1505ddb4d2682fb5ab8f8a354ad58e0986f1c6c88ea26365
MD5 fb24abf484c484670be0444a7ae0f918
SHA1 c4e9e2fdb62f3b0f420c6bb80f1252a2ab66bd4a
SHA512 0b1e939527648c5129f7d2198d170d5ab5207c916ff524f8c6922951263923e736a1994a16e561b2350ca876e959047ee5815e4c9f7080aaa5343930b8e1983e
SSDEEP 1536:kPWcE0SRO8Ns692U9nsFT4MjLhcK7H9rNF+mghmtM5CBH/kZVqNMNk4Asabiv00o:k+IqTsdJZaBkhxrL06PCDLODn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	671b8430e5d809ec1505ddb4d2682fb5ab8f8a354ad58e0986f1c6c88ea26365.bin
File opened for modification	/dev/watchdog	671b8430e5d809ec1505ddb4d2682fb5ab8f8a354ad58e0986f1c6c88ea26365.bin

/tmp/671b8430e5d809ec1505ddb4d2682fb5ab8f8a354ad58e0986f1c6c88ea26365.bin
/tmp/671b8430e5d809ec1505ddb4d2682fb5ab8f8a354ad58e0986f1c6c88ea26365.bin
1⤵
- Modifies Watchdog functionality
PID:783
- /usr/local/sbin/iptables
  iptables -C OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:787
- /usr/local/bin/iptables
  iptables -C OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:787
- /usr/sbin/iptables
  iptables -C OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:787
- /usr/bin/iptables
  iptables -C OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:787
- /sbin/iptables
  iptables -C OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:787
- /bin/iptables
  iptables -C OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:787
- /usr/local/bin/iptables
  iptables -C OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:787
- /bin/iptables
  iptables -C OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:787
- /usr/bin/iptables
  iptables -C OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:787
- /sbin/iptables
  iptables -C OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:787
- /usr/sbin/iptables
  iptables -C OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:787
- /usr/local/sbin/iptables
  iptables -C OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:787
- /usr/local/sbin/iptables
  iptables -I OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:788
- /usr/local/bin/iptables
  iptables -I OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:788
- /usr/sbin/iptables
  iptables -I OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:788
- /usr/bin/iptables
  iptables -I OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:788
- /sbin/iptables
  iptables -I OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:788
- /bin/iptables
  iptables -I OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:788
- /usr/local/bin/iptables
  iptables -I OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:788
- /bin/iptables
  iptables -I OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:788
- /usr/bin/iptables
  iptables -I OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:788
- /sbin/iptables
  iptables -I OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:788
- /usr/sbin/iptables
  iptables -I OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:788
- /usr/local/sbin/iptables
  iptables -I OUTPUT -p tcp --tcp-flags RST RST -j DROP --sport 50000:55000
  2⤵
  PID:788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads