Analysis
- max time kernel
149s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
19/05/2026, 02:01
Behavioral task
behavioral1
Sample
8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c
Resource
debian12-armhf-20260127-en
debian-12-armhf
5 signatures
150 seconds
General
- Target 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c
- Size 83KB
- Sample260519-cfpchae16s
- SHA256 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c
- MD5 25fd3834002eaaf67c17d25bec2bff97
- SHA1 c8be102127d3c74d1a28b4eb442acb6d966c6ade
- SHA512 e5d5093cf2baf07e8d09fab348c26bedccc65ead79bed3d90287cf6aa7a44e5339e2345c72a0fcde373bc08cbffc0b92869a085427b436251fb3bfad6b81ab83
- SSDEEP 1536:Net7qvHhrxVzXYrgEiNvKEJmTdnp7+2bvefYu2ZJnVmw7EsviUy5g89DR5j:Yt7qvpXzXYrg9vKEMBwgeG9Vx7Esv3hw
- TLSH T1D38302051B4B5673BC80587347A829F16BC7B3D194FD2B9638DD4B26A8AB6937EB0310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for modification /dev/misc/watchdog 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for modification /bin/watchdog 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c -
description ioc Process File opened for reading /proc/31/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/45/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/198/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/1/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/14/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/15/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/34/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/35/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/3/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/10/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/20/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/36/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/42/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/330/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/805/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/56/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/193/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/200/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/self/exe 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/6/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/25/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/30/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/22/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/73/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/317/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/11/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/16/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/23/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/26/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/28/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/341/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/804/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/818/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/19/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/21/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/143/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/642/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/787/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/826/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/5/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/27/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/29/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/142/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/352/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/641/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/680/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/770/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/371/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/732/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/18/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/218/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/250/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/356/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/799/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/800/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/44/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/9/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/24/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/33/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/46/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/2/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/4/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/51/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c File opened for reading /proc/57/status 8a178d5d28208328343bb3e584e590036aee95db8b9aeb95bd14879b6fadeb1c