Analysis
- max time kernel
149s - max time network
148s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
19/05/2026, 23:44
Behavioral task
behavioral1
Sample
micro.arm7.elf
Resource
debian12-armhf-20260513-en
2 signatures
150 seconds
General
- Target micro.arm7.elf
- Size 160KB
- Sample260519-3rhbfady2y
- SHA256 7bbd5d39fdd5ccdbff406167061cad9e5078c1b82a900063480f1f7dfaf45831
- MD5 d15ff9e0cf516acfe495d0f993d6eb5d
- SHA1 bc50c705439a783740f59d7b01aa023a96f68f29
- SHA512 f31ee481ca80d02f5e25dc241dc421c70dc3240b6c2ace770beb4ac5796dc6145714e999eaecfdc1f8dff9a6e26899c031f35b1fae473963703598aea6d8b457
- SSDEEP 3072:0y8hPgyS7DhaJ9L6NNnoYrPSWDxXAmz+3L/KQTm:8gpvhaJ9L6NNoYVxXAmCL/KQTm
- TLSH T16BF34A46FB804E17C0D61779B69F43153323DB6493EB73069928ABB43F837AE4E62605
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog micro.arm7.elf File opened for modification /dev/misc/watchdog micro.arm7.elf - Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog micro.arm7.elf File opened for modification /bin/watchdog micro.arm7.elf