Analysis
- max time kernel
8s - max time network
153s - platform
debian-12_armhf - resource
debian12-armhf-20260126-en - resource tags
arch:armhfimage:debian12-armhf-20260126-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
15/04/2026, 12:15
Behavioral task
behavioral1
Sample
Space.arm7
Resource
debian12-armhf-20260126-en
debian-12-armhf
5 signatures
150 seconds
General
- Target Space.arm7
- Size 60KB
- Sample260415-pe4f9adv3m
- SHA256 00ed9322003adc1cc907bd507d6df5bcf46506f3f9bc9dccf703870bc2b92d76
- MD5 9bffc3e0deb9cfbe55fb5594ee05d730
- SHA1 02b25ba6f51c513fe5c24baaa701351d614a89e7
- SHA512 47f9977def0dd9f56ab5dc1de7b32079f03e3b131f5e0abda058998c6b2b732045fd5b92435df544a6e0d727e012747df75963a77fb7874b67d3b346baf39702
- SSDEEP 1536:Y7XduYshWhq/HIEy6Og3Nwz9hAyXELOLSM5Tfv83KJGTb6R4a:qdpssMPR9w4yDLXTX83K0Tb6RV
- TLSH T1C0531262D80368BAE7237D77B3F00EC3FA0D4B72749C687821993158FAE55612C61397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Space.arm7 File opened for modification /dev/misc/watchdog Space.arm7 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Space.arm7 File opened for modification /bin/watchdog Space.arm7 -
description ioc Process File opened for reading /proc/29/status Space.arm7 File opened for reading /proc/56/status Space.arm7 File opened for reading /proc/143/status Space.arm7 File opened for reading /proc/193/status Space.arm7 File opened for reading /proc/218/status Space.arm7 File opened for reading /proc/641/status Space.arm7 File opened for reading /proc/733/status Space.arm7 File opened for reading /proc/12/status Space.arm7 File opened for reading /proc/19/status Space.arm7 File opened for reading /proc/31/status Space.arm7 File opened for reading /proc/42/status Space.arm7 File opened for reading /proc/44/status Space.arm7 File opened for reading /proc/315/status Space.arm7 File opened for reading /proc/730/status Space.arm7 File opened for reading /proc/785/status Space.arm7 File opened for reading /proc/10/status Space.arm7 File opened for reading /proc/33/status Space.arm7 File opened for reading /proc/51/status Space.arm7 File opened for reading /proc/776/status Space.arm7 File opened for reading /proc/1/status Space.arm7 File opened for reading /proc/20/status Space.arm7 File opened for reading /proc/142/status Space.arm7 File opened for reading /proc/318/status Space.arm7 File opened for reading /proc/642/status Space.arm7 File opened for reading /proc/783/status Space.arm7 File opened for reading /proc/8/status Space.arm7 File opened for reading /proc/14/status Space.arm7 File opened for reading /proc/23/status Space.arm7 File opened for reading /proc/30/status Space.arm7 File opened for reading /proc/353/status Space.arm7 File opened for reading /proc/32/status Space.arm7 File opened for reading /proc/200/status Space.arm7 File opened for reading /proc/312/status Space.arm7 File opened for reading /proc/331/status Space.arm7 File opened for reading /proc/342/status Space.arm7 File opened for reading /proc/376/status Space.arm7 File opened for reading /proc/28/status Space.arm7 File opened for reading /proc/359/status Space.arm7 File opened for reading /proc/622/status Space.arm7 File opened for reading /proc/728/status Space.arm7 File opened for reading /proc/4/status Space.arm7 File opened for reading /proc/25/status Space.arm7 File opened for reading /proc/35/status Space.arm7 File opened for reading /proc/46/status Space.arm7 File opened for reading /proc/667/status Space.arm7 File opened for reading /proc/771/status Space.arm7 File opened for reading /proc/self/exe Space.arm7 File opened for reading /proc/3/status Space.arm7 File opened for reading /proc/9/status Space.arm7 File opened for reading /proc/21/status Space.arm7 File opened for reading /proc/34/status Space.arm7 File opened for reading /proc/73/status Space.arm7 File opened for reading /proc/673/status Space.arm7 File opened for reading /proc/198/status Space.arm7 File opened for reading /proc/2/status Space.arm7 File opened for reading /proc/11/status Space.arm7 File opened for reading /proc/17/status Space.arm7 File opened for reading /proc/252/status Space.arm7 File opened for reading /proc/760/status Space.arm7 File opened for reading /proc/770/status Space.arm7 File opened for reading /proc/6/status Space.arm7 File opened for reading /proc/7/status Space.arm7 File opened for reading /proc/18/status Space.arm7 File opened for reading /proc/36/status Space.arm7