Analysis
- max time kernel
150s - max time network
145s - platform
debian-12_armhf - resource
debian12-armhf-20260126-en - resource tags
arch:armhfimage:debian12-armhf-20260126-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
07/05/2026, 06:19
Static task
static1
Behavioral task
behavioral1
Sample
bin.armv7l
Resource
debian12-armhf-20260126-en
debian-12-armhf
7 signatures
150 seconds
General
- Target bin.armv7l
- Size 196KB
- Sample260507-g3ffbsf17t
- SHA256 35c4220b71143da2d5c586ed616da82620700d8e8bf9cbed5263b3d4b54656f8
- MD5 9f512872b96791c1059a1b7e4dc6fc90
- SHA1 f48ba5d7ccbe907bfa71ad4d512e49d863fe28e7
- SHA512 7592dd558ae23a64d2d4421463f149a344610fd4220e4518fa706bb721912396d1d9fd5693d6a56f959ed68d517a6edcdecc3a92dfbd2e2702d58edf6849f15e
- SSDEEP 6144:AkRmDBTWjYBPE2hofrka7fU3FjCwEAb//Xpl4jbAj:AkR6TwYtPhofrka7UFjCwEoHpl4jb
- TLSH T1D014F64AB9919F11D5D235FEFA9F419833236BA8D3FA7102DD206F6033C699B0B76112
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
description ioc Process File deleted /var/log/audit/audit.log bin.armv7l - Deletes itself 1 IoCs
pid Process 803 bin.armv7l - Deletes journal logs 1 TTPs 1 IoCs
Deletes systemd journal logs. Likely to evade detection.
description ioc Process File deleted /var/log/journal/65779e181e584f059cb9deb1099989c3/system.journal bin.armv7l - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog bin.armv7l File opened for modification /dev/misc/watchdog bin.armv7l - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 6 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself MAIN 800 bin.armv7l Changes the process name, possibly in an attempt to hide itself ESI 801 bin.armv7l Changes the process name, possibly in an attempt to hide itself MUSHI_KILLER 802 bin.armv7l Changes the process name, possibly in an attempt to hide itself LOCKER 803 bin.armv7l Changes the process name, possibly in an attempt to hide itself CONNECTION 805 bin.armv7l Changes the process name, possibly in an attempt to hide itself CONNECTION 806 bin.armv7l -
description ioc Process File opened for reading /proc/402/cmdline bin.armv7l File opened for reading /proc/779/cmdline bin.armv7l File opened for reading /proc/27/cmdline bin.armv7l File opened for reading /proc/3/stat bin.armv7l File opened for reading /proc/8/stat bin.armv7l File opened for reading /proc/73/stat bin.armv7l File opened for reading /proc/365/cmdline bin.armv7l File opened for reading /proc/13/cmdline bin.armv7l File opened for reading /proc/24/cmdline bin.armv7l File opened for reading /proc/319/stat bin.armv7l File opened for reading /proc/640/cmdline bin.armv7l File opened for reading /proc/781/stat bin.armv7l File opened for reading /proc/785/stat bin.armv7l File opened for reading /proc/2/cmdline bin.armv7l File opened for reading /proc/9/cmdline bin.armv7l File opened for reading /proc/622/cmdline bin.armv7l File opened for reading /proc/809/cmdline bin.armv7l File opened for reading /proc/22/cmdline bin.armv7l File opened for reading /proc/674/stat bin.armv7l File opened for reading /proc/6/stat bin.armv7l File opened for reading /proc/329/stat bin.armv7l File opened for reading /proc/808/cmdline bin.armv7l File opened for reading /proc/7/stat bin.armv7l File opened for reading /proc/13/stat bin.armv7l File opened for reading /proc/28/stat bin.armv7l File opened for reading /proc/193/stat bin.armv7l File opened for reading /proc/357/cmdline bin.armv7l File opened for reading /proc/729/stat bin.armv7l File opened for reading /proc/6/cmdline bin.armv7l File opened for reading /proc/18/cmdline bin.armv7l File opened for reading /proc/20/cmdline bin.armv7l File opened for reading /proc/319/cmdline bin.armv7l File opened for reading /proc/23/stat bin.armv7l File opened for reading /proc/32/stat bin.armv7l File opened for reading /proc/46/stat bin.armv7l File opened for reading /proc/728/stat bin.armv7l File opened for reading /proc/781/cmdline bin.armv7l File opened for reading /proc/796/stat bin.armv7l File opened for reading /proc/211/cmdline bin.armv7l File opened for reading /proc/1/stat bin.armv7l File opened for reading /proc/2/stat bin.armv7l File opened for reading /proc/7/cmdline bin.armv7l File opened for reading /proc/21/cmdline bin.armv7l File opened for reading /proc/26/cmdline bin.armv7l File opened for reading /proc/27/stat bin.armv7l File opened for reading /proc/30/stat bin.armv7l File opened for reading /proc/28/cmdline bin.armv7l File opened for reading /proc/34/stat bin.armv7l File opened for reading /proc/56/stat bin.armv7l File opened for reading /proc/142/stat bin.armv7l File opened for reading /proc/198/stat bin.armv7l File opened for reading /proc/stat bin.armv7l File opened for reading /proc/12/stat bin.armv7l File opened for reading /proc/30/cmdline bin.armv7l File opened for reading /proc/211/stat bin.armv7l File opened for reading /proc/812/cmdline bin.armv7l File opened for reading /proc/11/cmdline bin.armv7l File opened for reading /proc/25/cmdline bin.armv7l File opened for reading /proc/29/stat bin.armv7l File opened for reading /proc/36/stat bin.armv7l File opened for reading /proc/14/stat bin.armv7l File opened for reading /proc/15/stat bin.armv7l File opened for reading /proc/36/cmdline bin.armv7l File opened for reading /proc/51/stat bin.armv7l