Analysis
- max time kernel
145s - max time network
148s - platform
debian-12_armhf - resource
debian12-armhf-20260126-en - resource tags
arch:armhfimage:debian12-armhf-20260126-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
22/04/2026, 08:02
Behavioral task
behavioral1
Sample
luxzz.arm7.elf
Resource
debian12-armhf-20260126-en
debian-12-armhf
5 signatures
150 seconds
General
- Target luxzz.arm7.elf
- Size 75KB
- Sample260422-jxc45ae151
- SHA256 2ea0d31c3c95a87eb483e6444e1a3d8a9fefcbad95ce3375370ff4b6dccc87d8
- MD5 19975cd129fa660713ec621c24ef2fb1
- SHA1 b6e8d4ab6888754c765bc5d925e7c5d85d8960ac
- SHA512 ece908a33ee18aa8653cf79a31f9e88836d28eccb591669cbd3a32abfbfb98a5c5245d6847d86bea2164282b6f1ec0752d2130fd0123a3a4bb7314b44ebd6b88
- SSDEEP 1536:7t/53cJDRHOOjK48HtwaY9PELOha/ny41DAAE9e5SZ9Yi9LAZBiodG:pxgRuOjKxwaY9PaOgyIDAAEeCmBikG
- TLSH T1D57301AA23E8F766F62717F260732AC03B5528D8500F8663B519798DC5DE142244BFBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
manzzkontolaktolakan.my.id
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog luxzz.arm7.elf File opened for modification /dev/misc/watchdog luxzz.arm7.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog luxzz.arm7.elf File opened for modification /bin/watchdog luxzz.arm7.elf -
description ioc Process File opened for reading /proc/782/status luxzz.arm7.elf File opened for reading /proc/7/status luxzz.arm7.elf File opened for reading /proc/14/status luxzz.arm7.elf File opened for reading /proc/17/status luxzz.arm7.elf File opened for reading /proc/19/status luxzz.arm7.elf File opened for reading /proc/21/status luxzz.arm7.elf File opened for reading /proc/23/status luxzz.arm7.elf File opened for reading /proc/44/status luxzz.arm7.elf File opened for reading /proc/57/status luxzz.arm7.elf File opened for reading /proc/12/status luxzz.arm7.elf File opened for reading /proc/193/status luxzz.arm7.elf File opened for reading /proc/27/status luxzz.arm7.elf File opened for reading /proc/10/status luxzz.arm7.elf File opened for reading /proc/20/status luxzz.arm7.elf File opened for reading /proc/29/status luxzz.arm7.elf File opened for reading /proc/668/status luxzz.arm7.elf File opened for reading /proc/51/status luxzz.arm7.elf File opened for reading /proc/733/status luxzz.arm7.elf File opened for reading /proc/8/status luxzz.arm7.elf File opened for reading /proc/32/status luxzz.arm7.elf File opened for reading /proc/42/status luxzz.arm7.elf File opened for reading /proc/357/status luxzz.arm7.elf File opened for reading /proc/768/status luxzz.arm7.elf File opened for reading /proc/785/status luxzz.arm7.elf File opened for reading /proc/790/status luxzz.arm7.elf File opened for reading /proc/5/status luxzz.arm7.elf File opened for reading /proc/56/status luxzz.arm7.elf File opened for reading /proc/30/status luxzz.arm7.elf File opened for reading /proc/783/status luxzz.arm7.elf File opened for reading /proc/2/status luxzz.arm7.elf File opened for reading /proc/35/status luxzz.arm7.elf File opened for reading /proc/15/status luxzz.arm7.elf File opened for reading /proc/45/status luxzz.arm7.elf File opened for reading /proc/346/status luxzz.arm7.elf File opened for reading /proc/793/status luxzz.arm7.elf File opened for reading /proc/4/status luxzz.arm7.elf File opened for reading /proc/16/status luxzz.arm7.elf File opened for reading /proc/18/status luxzz.arm7.elf File opened for reading /proc/143/status luxzz.arm7.elf File opened for reading /proc/198/status luxzz.arm7.elf File opened for reading /proc/319/status luxzz.arm7.elf File opened for reading /proc/320/status luxzz.arm7.elf File opened for reading /proc/643/status luxzz.arm7.elf File opened for reading /proc/36/status luxzz.arm7.elf File opened for reading /proc/363/status luxzz.arm7.elf File opened for reading /proc/674/status luxzz.arm7.elf File opened for reading /proc/784/status luxzz.arm7.elf File opened for reading /proc/791/status luxzz.arm7.elf File opened for reading /proc/22/status luxzz.arm7.elf File opened for reading /proc/73/status luxzz.arm7.elf File opened for reading /proc/343/status luxzz.arm7.elf File opened for reading /proc/24/status luxzz.arm7.elf File opened for reading /proc/13/status luxzz.arm7.elf File opened for reading /proc/11/status luxzz.arm7.elf File opened for reading /proc/31/status luxzz.arm7.elf File opened for reading /proc/46/status luxzz.arm7.elf File opened for reading /proc/142/status luxzz.arm7.elf File opened for reading /proc/200/status luxzz.arm7.elf File opened for reading /proc/253/status luxzz.arm7.elf File opened for reading /proc/9/status luxzz.arm7.elf File opened for reading /proc/26/status luxzz.arm7.elf File opened for reading /proc/622/status luxzz.arm7.elf File opened for reading /proc/642/status luxzz.arm7.elf File opened for reading /proc/728/status luxzz.arm7.elf