Analysis
- max time kernel
144s - max time network
147s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
28/05/2026, 12:36
Behavioral task
behavioral1
Sample
176.65.139.111_sample.bin
Resource
debian12-armhf-20260513-en
2 signatures
150 seconds
General
- Target 176.65.139.111_sample.bin
- Size 105KB
- Sample260528-ps3f4sfx7l
- SHA256 75481f6469e9324b1d132bfa9a3a86d6d121647f566a4b2d933b17e197065744
- MD5 edfd520077e35c41ca2883ed51fa62fc
- SHA1 5f5ef5cb563638402c2cb386f367389f24133e19
- SHA512 a84bec3de0654a87db7864c89c1080fbc567c45ef9e095bc8bbf7e1f639cf5cd9be551d99b2f87b4560391bf909e10e5b670db5aa2f3057921cec405b3c0fdd4
- SSDEEP 3072:/gazwz102cpveoPaRl+UfacSAI8ywMJg:4azwz102cPPaRl+AS97Jg
- TLSH T141B33959B9818B22C5C212BAFA1E128E331357B8E3DF73179D241F6477C696B0E7B901
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 176.65.139.111_sample.bin File opened for modification /dev/misc/watchdog 176.65.139.111_sample.bin - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself QERGKnhZrFnFlVu 779 176.65.139.111_sample.bin