Analysis
- max time kernel
145s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20250619-en - resource tags
arch:armhfimage:debian12-armhf-20250619-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
29/11/2025, 04:06
Behavioral task
behavioral1
Sample
arm7.elf
Resource
debian12-armhf-20250619-en
debian-12-armhf
6 signatures
150 seconds
General
- Target arm7.elf
- Size 46KB
- Sample251129-epd91avpdn
- SHA256 4a4b9455ce2a3e2ef604d0594bb805344491435b23f2f49aff89ff1113e0b31c
- MD5 c956d527788f5e2e427abc7005b9913a
- SHA1 10bdb8b50ac75a4938b3ddf67d4b8d30f2a8407f
- SHA512 b19100b69ad1b54a55fe45e17afc39c545df8ab88a1e5b55a3b5a0d44401ce582ba76973ade5e13f1905b70d8118dae034537c6fab806cf31aef16a4f018f77a
- SSDEEP 768:f9p4OQrbFJ6eQAHV6PbLKwhUF6GyrCiuBDJ6W4mnyLIPzP0cJx09q3UELp:f9BLex16P60Anyr/YYW08Pb0YTLp
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
teamc2.duckdns.org
Signatures
- Mirai family
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog arm7.elf File opened for modification /dev/misc/watchdog arm7.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog arm7.elf File opened for modification /bin/watchdog arm7.elf -
description ioc Process File opened for reading /proc/393/status arm7.elf File opened for reading /proc/2/status arm7.elf File opened for reading /proc/27/status arm7.elf File opened for reading /proc/51/status arm7.elf File opened for reading /proc/642/status arm7.elf File opened for reading /proc/776/status arm7.elf File opened for reading /proc/11/status arm7.elf File opened for reading /proc/17/status arm7.elf File opened for reading /proc/20/status arm7.elf File opened for reading /proc/22/status arm7.elf File opened for reading /proc/45/status arm7.elf File opened for reading /proc/193/status arm7.elf File opened for reading /proc/623/status arm7.elf File opened for reading /proc/727/status arm7.elf File opened for reading /proc/198/status arm7.elf File opened for reading /proc/782/status arm7.elf File opened for reading /proc/789/status arm7.elf File opened for reading /proc/10/status arm7.elf File opened for reading /proc/15/status arm7.elf File opened for reading /proc/35/status arm7.elf File opened for reading /proc/42/status arm7.elf File opened for reading /proc/309/status arm7.elf File opened for reading /proc/319/status arm7.elf File opened for reading /proc/23/status arm7.elf File opened for reading /proc/57/status arm7.elf File opened for reading /proc/143/status arm7.elf File opened for reading /proc/330/status arm7.elf File opened for reading /proc/641/status arm7.elf File opened for reading /proc/674/status arm7.elf File opened for reading /proc/self/exe arm7.elf File opened for reading /proc/1/status arm7.elf File opened for reading /proc/4/status arm7.elf File opened for reading /proc/26/status arm7.elf File opened for reading /proc/199/status arm7.elf File opened for reading /proc/731/status arm7.elf File opened for reading /proc/773/status arm7.elf File opened for reading /proc/779/status arm7.elf File opened for reading /proc/8/status arm7.elf File opened for reading /proc/30/status arm7.elf File opened for reading /proc/32/status arm7.elf File opened for reading /proc/320/status arm7.elf File opened for reading /proc/364/status arm7.elf File opened for reading /proc/786/status arm7.elf File opened for reading /proc/16/status arm7.elf File opened for reading /proc/28/status arm7.elf File opened for reading /proc/250/status arm7.elf File opened for reading /proc/760/status arm7.elf File opened for reading /proc/3/status arm7.elf File opened for reading /proc/9/status arm7.elf File opened for reading /proc/25/status arm7.elf File opened for reading /proc/29/status arm7.elf File opened for reading /proc/44/status arm7.elf File opened for reading /proc/46/status arm7.elf File opened for reading /proc/5/status arm7.elf File opened for reading /proc/24/status arm7.elf File opened for reading /proc/31/status arm7.elf File opened for reading /proc/36/status arm7.elf File opened for reading /proc/73/status arm7.elf File opened for reading /proc/212/status arm7.elf File opened for reading /proc/13/status arm7.elf File opened for reading /proc/21/status arm7.elf File opened for reading /proc/56/status arm7.elf File opened for reading /proc/352/status arm7.elf File opened for reading /proc/18/status arm7.elf