Analysis
- max time kernel
145s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260126-en - resource tags
arch:armhfimage:debian12-armhf-20260126-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
27/04/2026, 00:59
Static task
static1
Behavioral task
behavioral1
Sample
xdf.arm6
Resource
debian12-armhf-20260126-en
debian-12-armhf
7 signatures
150 seconds
General
- Target xdf.arm6
- Size 100KB
- Sample260427-bb8pxaaz71
- SHA256 81e941f34934d6a06d89b2aad020eb9c7aa135f4735d38e99742e3b86a336d29
- MD5 f1ecb3c68b123c9c29ede1f90c4c047c
- SHA1 76774d50717c5c47dfb7377f36e71433afbbc1c1
- SHA512 f2b8f51929a261ae457290084d9cd16538729a4d023077755ccc6fba43950cd00d587bf48b9d7bce36535117f44b598c2e25de3d9399e1e7095213c8776a981d
- SSDEEP 3072:SxsW6X+UWUa3bzF9s6a9aaeSjxXW1N+fUn/3jPy:CBa39anQxXOnLPy
- TLSH T1DDA3E849F9646B19C3E232FFFA49428F73171FE8B3EA70258E305BA033C5AA51539525
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Contacts a large (565) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Deletes itself 1 IoCs
pid Process 783 xdf.arm6 - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog xdf.arm6 File opened for modification /dev/misc/watchdog xdf.arm6 - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/257/maps xdf.arm6 File opened for reading /proc/728/maps xdf.arm6 File opened for reading /proc/21/maps xdf.arm6 File opened for reading /proc/24/maps xdf.arm6 File opened for reading /proc/42/maps xdf.arm6 File opened for reading /proc/10/maps xdf.arm6 File opened for reading /proc/29/maps xdf.arm6 File opened for reading /proc/32/maps xdf.arm6 File opened for reading /proc/208/maps xdf.arm6 File opened for reading /proc/211/maps xdf.arm6 File opened for reading /proc/319/maps xdf.arm6 File opened for reading /proc/799/maps xdf.arm6 File opened for reading /proc/23/maps xdf.arm6 File opened for reading /proc/2/maps xdf.arm6 File opened for reading /proc/7/maps xdf.arm6 File opened for reading /proc/44/maps xdf.arm6 File opened for reading /proc/45/maps xdf.arm6 File opened for reading /proc/46/maps xdf.arm6 File opened for reading /proc/142/maps xdf.arm6 File opened for reading /proc/639/maps xdf.arm6 File opened for reading /proc/15/maps xdf.arm6 File opened for reading /proc/35/maps xdf.arm6 File opened for reading /proc/309/maps xdf.arm6 File opened for reading /proc/321/maps xdf.arm6 File opened for reading /proc/366/maps xdf.arm6 File opened for reading /proc/28/maps xdf.arm6 File opened for reading /proc/30/maps xdf.arm6 File opened for reading /proc/33/maps xdf.arm6 File opened for reading /proc/36/maps xdf.arm6 File opened for reading /proc/676/maps xdf.arm6 File opened for reading /proc/6/maps xdf.arm6 File opened for reading /proc/11/maps xdf.arm6 File opened for reading /proc/12/maps xdf.arm6 File opened for reading /proc/73/maps xdf.arm6 File opened for reading /proc/390/maps xdf.arm6 File opened for reading /proc/640/maps xdf.arm6 File opened for reading /proc/8/maps xdf.arm6 File opened for reading /proc/9/maps xdf.arm6 File opened for reading /proc/16/maps xdf.arm6 File opened for reading /proc/17/maps xdf.arm6 File opened for reading /proc/143/maps xdf.arm6 File opened for reading /proc/778/maps xdf.arm6 File opened for reading /proc/784/maps xdf.arm6 File opened for reading /proc/18/maps xdf.arm6 File opened for reading /proc/19/maps xdf.arm6 File opened for reading /proc/330/maps xdf.arm6 File opened for reading /proc/354/maps xdf.arm6 File opened for reading /proc/621/maps xdf.arm6 File opened for reading /proc/26/maps xdf.arm6 File opened for reading /proc/51/maps xdf.arm6 File opened for reading /proc/363/maps xdf.arm6 File opened for reading /proc/777/maps xdf.arm6 File opened for reading /proc/3/maps xdf.arm6 File opened for reading /proc/5/maps xdf.arm6 File opened for reading /proc/22/maps xdf.arm6 File opened for reading /proc/56/maps xdf.arm6 File opened for reading /proc/193/maps xdf.arm6 File opened for reading /proc/765/maps xdf.arm6 File opened for reading /proc/25/maps xdf.arm6 File opened for reading /proc/31/maps xdf.arm6 File opened for reading /proc/34/maps xdf.arm6 File opened for reading /proc/334/maps xdf.arm6 File opened for reading /proc/670/maps xdf.arm6 File opened for reading /proc/4/maps xdf.arm6 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself uucp 783 xdf.arm6 -
description ioc Process File opened for reading /proc/12/cmdline xdf.arm6 File opened for reading /proc/46/cmdline xdf.arm6 File opened for reading /proc/777/cmdline xdf.arm6 File opened for reading /proc/19/cmdline xdf.arm6 File opened for reading /proc/27/cmdline xdf.arm6 File opened for reading /proc/30/cmdline xdf.arm6 File opened for reading /proc/621/cmdline xdf.arm6 File opened for reading /proc/799/cmdline xdf.arm6 File opened for reading /proc/6/cmdline xdf.arm6 File opened for reading /proc/9/cmdline xdf.arm6 File opened for reading /proc/13/cmdline xdf.arm6 File opened for reading /proc/28/cmdline xdf.arm6 File opened for reading /proc/56/cmdline xdf.arm6 File opened for reading /proc/354/cmdline xdf.arm6 File opened for reading /proc/390/cmdline xdf.arm6 File opened for reading /proc/670/cmdline xdf.arm6 File opened for reading /proc/15/cmdline xdf.arm6 File opened for reading /proc/20/cmdline xdf.arm6 File opened for reading /proc/676/cmdline xdf.arm6 File opened for reading /proc/3/cmdline xdf.arm6 File opened for reading /proc/5/cmdline xdf.arm6 File opened for reading /proc/8/cmdline xdf.arm6 File opened for reading /proc/11/cmdline xdf.arm6 File opened for reading /proc/31/cmdline xdf.arm6 File opened for reading /proc/14/cmdline xdf.arm6 File opened for reading /proc/22/cmdline xdf.arm6 File opened for reading /proc/45/cmdline xdf.arm6 File opened for reading /proc/728/cmdline xdf.arm6 File opened for reading /proc/17/cmdline xdf.arm6 File opened for reading /proc/33/cmdline xdf.arm6 File opened for reading /proc/193/cmdline xdf.arm6 File opened for reading /proc/321/cmdline xdf.arm6 File opened for reading /proc/32/cmdline xdf.arm6 File opened for reading /proc/257/cmdline xdf.arm6 File opened for reading /proc/639/cmdline xdf.arm6 File opened for reading /proc/640/cmdline xdf.arm6 File opened for reading /proc/4/cmdline xdf.arm6 File opened for reading /proc/16/cmdline xdf.arm6 File opened for reading /proc/26/cmdline xdf.arm6 File opened for reading /proc/34/cmdline xdf.arm6 File opened for reading /proc/208/cmdline xdf.arm6 File opened for reading /proc/334/cmdline xdf.arm6 File opened for reading /proc/366/cmdline xdf.arm6 File opened for reading /proc/7/cmdline xdf.arm6 File opened for reading /proc/23/cmdline xdf.arm6 File opened for reading /proc/44/cmdline xdf.arm6 File opened for reading /proc/319/cmdline xdf.arm6 File opened for reading /proc/778/cmdline xdf.arm6 File opened for reading /proc/25/cmdline xdf.arm6 File opened for reading /proc/198/cmdline xdf.arm6 File opened for reading /proc/211/cmdline xdf.arm6 File opened for reading /proc/2/cmdline xdf.arm6 File opened for reading /proc/42/cmdline xdf.arm6 File opened for reading /proc/73/cmdline xdf.arm6 File opened for reading /proc/765/cmdline xdf.arm6 File opened for reading /proc/10/cmdline xdf.arm6 File opened for reading /proc/24/cmdline xdf.arm6 File opened for reading /proc/29/cmdline xdf.arm6 File opened for reading /proc/57/cmdline xdf.arm6 File opened for reading /proc/142/cmdline xdf.arm6 File opened for reading /proc/363/cmdline xdf.arm6 File opened for reading /proc/21/cmdline xdf.arm6 File opened for reading /proc/35/cmdline xdf.arm6 File opened for reading /proc/143/cmdline xdf.arm6