Analysis
- max time kernel
149s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
17/04/2026, 02:20
Behavioral task
behavioral1
Sample
parm7.elf
Resource
debian12-armhf-20260127-en
debian-12-armhf
4 signatures
150 seconds
General
- Target parm7.elf
- Size 150KB
- Sample260417-csv1tadx5k
- SHA256 3ffa61bb30699516e9aee0b1dc7052005441f4b9027adc5168e8dc7c42208614
- MD5 63bc73c0adb3acf412c44169a4e91972
- SHA1 1f95424e172635254a325362dabcbb701465b932
- SHA512 27403b997c1ebe3a25156e7033877594dae4f4b8b918018256f249b57910581254fcb43b04c373e46a4af4b26a3f48decbfa25e8c953366e659b0aa371964134
- SSDEEP 3072:X5uRoJ48aV7/HBcP0x57mW7gz4habLNJmM/9wGS:X5uF8aV7/HBcPs5V7A4QbLNMM/9vS
- TLSH T154E32A46E7408A13C4D6177ABAAF42453323AB64D3DB73059928BFB43F8279E0E67605
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 790 parm7.elf - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog parm7.elf File opened for modification /dev/misc/watchdog parm7.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself ohcfr330d3pv3lkmshe512n8 790 parm7.elf -
description ioc Process File opened for reading /proc/333�/cmdline parm7.elf File opened for reading /proc/777k�/cmdline parm7.elf File opened for reading /proc/1111�;cmdline parm7.elf File opened for reading /proc/6666 ;cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/22cmdline parm7.elf File opened for reading /proc/3333X5cmdline parm7.elf File opened for reading /proc/3333/stat parm7.elf File opened for reading /proc/111ut/cmdline parm7.elf File opened for reading /proc/222m�/cmdline parm7.elf File opened for reading /proc/555s�/cmdline parm7.elf File opened for reading /proc/3333fffffffcmdline parm7.elf File opened for reading /proc/88/stat parm7.elf File opened for reading /proc/7777/stat parm7.elf File opened for reading /proc/8888�;cmdline parm7.elf File opened for reading /proc/33cmdline parm7.elf File opened for reading /proc/44cmdline parm7.elf File opened for reading /proc/55cmdline parm7.elf File opened for reading /proc/111c~/cmdline parm7.elf File opened for reading /proc/2222�3cmdline parm7.elf File opened for reading /proc/6666<8cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/222�/cmdline parm7.elf File opened for reading /proc/1111�1cmdline parm7.elf File opened for reading /proc/3333�4cmdline parm7.elf File opened for reading /proc/6666U7cmdline parm7.elf File opened for reading /proc/66/stat parm7.elf File opened for reading /proc/222/stat parm7.elf File opened for reading /proc/444/stat parm7.elf File opened for reading /proc/6666�;cmdline parm7.elf File opened for reading /proc/333s�/cmdline parm7.elf File opened for reading /proc/22/stat parm7.elf File opened for reading /proc/44/stat parm7.elf File opened for reading /proc/111/stat parm7.elf File opened for reading /proc/333/stat parm7.elf File opened for reading /proc/555/stat parm7.elf File opened for reading /proc/6666/stat parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/77cmdline parm7.elf File opened for reading /proc/88cmdline parm7.elf File opened for reading /proc/111c|/cmdline parm7.elf File opened for reading /proc/222c�/cmdline parm7.elf File opened for reading /proc/1111�;cmdline parm7.elf File opened for reading /proc/6666S8cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/222v�/cmdline parm7.elf File opened for reading /proc/333�/cmdline parm7.elf File opened for reading /proc/444d�/cmdline parm7.elf File opened for reading /proc/2222�2cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/11/stat parm7.elf File opened for reading /proc/33/stat parm7.elf File opened for reading /proc/111v/cmdline parm7.elf File opened for reading /proc/333cmdline parm7.elf File opened for reading /proc/333s�/cmdline parm7.elf File opened for reading /proc/8888cmdline parm7.elf File opened for reading /proc/99/stat parm7.elf File opened for reading /proc/7777cmdline parm7.elf File opened for reading /proc/1111/stat parm7.elf File opened for reading /proc/8888�;cmdline parm7.elf File opened for reading /proc/99ssj/cmdline parm7.elf