Analysis
- max time kernel
150s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20250619-en - resource tags
arch:armhfimage:debian12-armhf-20250619-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
08/05/2026, 18:31
Static task
static1
Behavioral task
behavioral1
Sample
nexus.arm6.elf
Resource
debian12-armhf-20250619-en
debian-12-armhf
9 signatures
150 seconds
General
- Target nexus.arm6.elf
- Size 79KB
- Sample260508-w6eersct3w
- SHA256 9893e5c61fc7ed96fde42b86d2143a80365797ec899eb4379cac5e0a43940fa6
- MD5 fc642a62ec6040025808cf2ebf6dfcc2
- SHA1 816b496496a9d9eb3807ba3bdaafafd767eafca6
- SHA512 c4232a1d250073d34fa88d73dcf5eddfa245bf3b9cfa323129419df262e28be625884822fba7bd339b8001ca1ee0e7125514e81024f7eb11a7f5a76ad256ac6d
- SSDEEP 1536:/lnsFxdCK/9Y9KqCLcQ99CHXtecGX79hLQTMciJSkNSxrPgf:aEu96KqCXyXUF9SkNSxr4f
- TLSH T1C983B549FA649B2DC7E272FFF74912CE332B1B98B7DA71259E305A4533C8BA65424130
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Contacts a large (122718) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nexus.arm6.elf File opened for modification /dev/misc/watchdog nexus.arm6.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 1 IoCs
description ioc Process File opened for modification /sbin/watchdog nexus.arm6.elf - Reads process memory 1 TTPs 32 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/623/maps nexus.arm6.elf File opened for reading /proc/823/maps nexus.arm6.elf File opened for reading /proc/729/maps nexus.arm6.elf File opened for reading /proc/784/maps nexus.arm6.elf File opened for reading /proc/801/maps nexus.arm6.elf File opened for reading /proc/806/maps nexus.arm6.elf File opened for reading /proc/815/maps nexus.arm6.elf File opened for reading /proc/1/maps nexus.arm6.elf File opened for reading /proc/344/maps nexus.arm6.elf File opened for reading /proc/360/maps nexus.arm6.elf File opened for reading /proc/378/maps nexus.arm6.elf File opened for reading /proc/677/maps nexus.arm6.elf File opened for reading /proc/733/maps nexus.arm6.elf File opened for reading /proc/212/maps nexus.arm6.elf File opened for reading /proc/359/maps nexus.arm6.elf File opened for reading /proc/369/maps nexus.arm6.elf File opened for reading /proc/641/maps nexus.arm6.elf File opened for reading /proc/728/maps nexus.arm6.elf File opened for reading /proc/783/maps nexus.arm6.elf File opened for reading /proc/809/maps nexus.arm6.elf File opened for reading /proc/193/maps nexus.arm6.elf File opened for reading /proc/367/maps nexus.arm6.elf File opened for reading /proc/769/maps nexus.arm6.elf File opened for reading /proc/788/maps nexus.arm6.elf File opened for reading /proc/819/maps nexus.arm6.elf File opened for reading /proc/672/maps nexus.arm6.elf File opened for reading /proc/288/maps nexus.arm6.elf File opened for reading /proc/289/maps nexus.arm6.elf File opened for reading /proc/341/maps nexus.arm6.elf File opened for reading /proc/357/maps nexus.arm6.elf File opened for reading /proc/640/maps nexus.arm6.elf File opened for reading /proc/790/maps nexus.arm6.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself 787 nexus.arm6.elf - Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/devices/virtual/misc/watchdog nexus.arm6.elf File opened for reading /sys/class/misc/watchdog nexus.arm6.elf File opened for reading /sys/class/watchdog nexus.arm6.elf -
description ioc Process File opened for reading /proc/728/exe nexus.arm6.elf File opened for reading /proc/823/exe nexus.arm6.elf File opened for reading /proc/360/exe nexus.arm6.elf File opened for reading /proc/809/exe nexus.arm6.elf File opened for reading /proc/819/exe nexus.arm6.elf File opened for reading /proc/788/exe nexus.arm6.elf File opened for reading /proc/790/exe nexus.arm6.elf File opened for reading /proc/806/exe nexus.arm6.elf File opened for reading /proc/289/exe nexus.arm6.elf File opened for reading /proc/341/exe nexus.arm6.elf File opened for reading /proc/815/exe nexus.arm6.elf File opened for reading /proc/378/exe nexus.arm6.elf File opened for reading /proc/783/exe nexus.arm6.elf File opened for reading /proc/193/exe nexus.arm6.elf File opened for reading /proc/367/exe nexus.arm6.elf File opened for reading /proc/623/exe nexus.arm6.elf File opened for reading /proc/1/exe nexus.arm6.elf File opened for reading /proc/344/exe nexus.arm6.elf File opened for reading /proc/357/exe nexus.arm6.elf File opened for reading /proc/359/exe nexus.arm6.elf File opened for reading /proc/733/exe nexus.arm6.elf File opened for reading /proc/369/exe nexus.arm6.elf File opened for reading /proc/640/exe nexus.arm6.elf File opened for reading /proc/677/exe nexus.arm6.elf File opened for reading /proc/729/exe nexus.arm6.elf File opened for reading /proc/769/exe nexus.arm6.elf File opened for reading /proc/784/exe nexus.arm6.elf File opened for reading /proc/212/exe nexus.arm6.elf File opened for reading /proc/288/exe nexus.arm6.elf File opened for reading /proc/641/exe nexus.arm6.elf File opened for reading /proc/672/exe nexus.arm6.elf File opened for reading /proc/801/exe nexus.arm6.elf