Analysis
- max time kernel
149s - max time network
136s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
24/03/2026, 03:59
Behavioral task
behavioral1
Sample
tux.arm7.elf
Resource
debian12-armhf-20260127-en
debian-12-armhf
4 signatures
150 seconds
General
- Target tux.arm7.elf
- Size 148KB
- Sample260324-ej7pcsdv4m
- SHA256 531b33dd1a79c4a57ca2aed8a2ecd97df05974c84d39d35b8ca4f568edba1ecf
- MD5 fbf5d3fa7a58b89e334d7a2d9254a77f
- SHA1 8dcedc19c2ce3d6faf770d1b5ed9425946e51c8e
- SHA512 302865d16ad5a39f091b09fc89a36b1077029292be1f3e69cf5d42e9326e95f87cf9825f75769e569a259383333c6a399324e2833201c453b0e67af4af0bf8e6
- SSDEEP 3072:aufh1cc4RRye0MKazEdXIZAF3G2Ov1WCWUc1M/9fl:auffxEtKazEdXIZk3GcCWUWM/9fl
- TLSH T154E34B56EB818B03C4D61775BAAF424533239B64D3DB73069928BFB43F8279E0E63502
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog tux.arm7.elf File opened for modification /dev/misc/watchdog tux.arm7.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 55 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/28/maps tux.arm7.elf File opened for reading /proc/26/maps tux.arm7.elf File opened for reading /proc/802/maps tux.arm7.elf File opened for reading /proc/729/maps tux.arm7.elf File opened for reading /proc/342/maps tux.arm7.elf File opened for reading /proc/35/maps tux.arm7.elf File opened for reading /proc/32/maps tux.arm7.elf File opened for reading /proc/31/maps tux.arm7.elf File opened for reading /proc/29/maps tux.arm7.elf File opened for reading /proc/27/maps tux.arm7.elf File opened for reading /proc/785/maps tux.arm7.elf File opened for reading /proc/641/maps tux.arm7.elf File opened for reading /proc/317/maps tux.arm7.elf File opened for reading /proc/316/maps tux.arm7.elf File opened for reading /proc/218/maps tux.arm7.elf File opened for reading /proc/45/maps tux.arm7.elf File opened for reading /proc/33/maps tux.arm7.elf File opened for reading /proc/30/maps tux.arm7.elf File opened for reading /proc/783/maps tux.arm7.elf File opened for reading /proc/675/maps tux.arm7.elf File opened for reading /proc/315/maps tux.arm7.elf File opened for reading /proc/198/maps tux.arm7.elf File opened for reading /proc/73/maps tux.arm7.elf File opened for reading /proc/57/maps tux.arm7.elf File opened for reading /proc/36/maps tux.arm7.elf File opened for reading /proc/34/maps tux.arm7.elf File opened for reading /proc/732/maps tux.arm7.elf File opened for reading /proc/680/maps tux.arm7.elf File opened for reading /proc/371/maps tux.arm7.elf File opened for reading /proc/359/maps tux.arm7.elf File opened for reading /proc/200/maps tux.arm7.elf File opened for reading /proc/193/maps tux.arm7.elf File opened for reading /proc/56/maps tux.arm7.elf File opened for reading /proc/46/maps tux.arm7.elf File opened for reading /proc/251/maps tux.arm7.elf File opened for reading /proc/787/maps tux.arm7.elf File opened for reading /proc/734/maps tux.arm7.elf File opened for reading /proc/640/maps tux.arm7.elf File opened for reading /proc/624/maps tux.arm7.elf File opened for reading /proc/340/maps tux.arm7.elf File opened for reading /proc/333/maps tux.arm7.elf File opened for reading /proc/44/maps tux.arm7.elf File opened for reading /proc/789/maps tux.arm7.elf File opened for reading /proc/353/maps tux.arm7.elf File opened for reading /proc/143/maps tux.arm7.elf File opened for reading /proc/142/maps tux.arm7.elf File opened for reading /proc/42/maps tux.arm7.elf File opened for reading /proc/801/maps tux.arm7.elf File opened for reading /proc/784/maps tux.arm7.elf File opened for reading /proc/800/maps tux.arm7.elf File opened for reading /proc/797/maps tux.arm7.elf File opened for reading /proc/788/maps tux.arm7.elf File opened for reading /proc/770/maps tux.arm7.elf File opened for reading /proc/728/maps tux.arm7.elf File opened for reading /proc/51/maps tux.arm7.elf - Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /var/Sofia 787 tux.arm7.elf Changes the process name, possibly in an attempt to hide itself /var/Sofia 786 tux.arm7.elf