Analysis
- max time kernel
149s - max time network
149s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
09/06/2026, 21:07
Behavioral task
behavioral1
Sample
parm7.elf
Resource
debian12-armhf-20260127-en
debian-12-armhf
5 signatures
150 seconds
General
- Target parm7.elf
- Size 98KB
- Sample260609-zyk45aas6m
- SHA256 3f2f76194be8ef9dcca6820a0ff688ea4c7995c970096cb4d5ff87cb3efa1af3
- MD5 094e73bf66e25f60cbf598a57fa45bc0
- SHA1 4f5980364e0d7a4cd7fb73ee7e4524977c56c572
- SHA512 a726004a1ad7e6d8d069b3b81d9d0d5cf731758e46425e79a84e11640bb733a42413a92620c1b83d02a8e1c3328cc4e151c5d46068de77061ffd0450aa72fed1
- SSDEEP 1536:nlEPwHV2QaZmbCekc1uVOaukaGHl25459WsYVve4FWpehbqngL/xNod/yaFhnfNJ:nlvMEpN1uVHzwXW0qngLTodHFJ6IN
- TLSH T1F2A3021916BE78B044B444F3BD740481647BAEC89EAE0C53FB251D391967B5BB7E0AC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
MIRAI
Signatures
- Deletes itself 1 IoCs
pid Process 791 parm7.elf - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog parm7.elf File opened for modification /dev/misc/watchdog parm7.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself scanbot 791 parm7.elf -
description ioc Process File opened for reading /proc/333/stat parm7.elf File opened for reading /proc/8888cmdline parm7.elf File opened for reading /proc/777/stat parm7.elf File opened for reading /proc/44cmdline parm7.elf File opened for reading /proc/222v�/cmdline parm7.elf File opened for reading /proc/333cmdline parm7.elf File opened for reading /proc/3333]5cmdline parm7.elf File opened for reading /proc/99/stat parm7.elf File opened for reading /proc/8888/stat parm7.elf File opened for reading /proc/8888�;cmdline parm7.elf File opened for reading /proc/111cu/cmdline parm7.elf File opened for reading /proc/222cmdline parm7.elf File opened for reading /proc/333�/cmdline parm7.elf File opened for reading /proc/1111/stat parm7.elf File opened for reading /proc/66cmdline parm7.elf File opened for reading /proc/222m�/cmdline parm7.elf File opened for reading /proc/3333K5cmdline parm7.elf File opened for reading /proc/6666�;cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/222l/cmdline parm7.elf File opened for reading /proc/33335cmdline parm7.elf File opened for reading /proc/6666D8cmdline parm7.elf File opened for reading /proc/33334cmdline parm7.elf File opened for reading /proc/3333�4cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/88cmdline parm7.elf File opened for reading /proc/99ssc/cmdline parm7.elf File opened for reading /proc/3333m4cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/8888�;cmdline parm7.elf File opened for reading /proc/6666�;cmdline parm7.elf File opened for reading /proc/111e/cmdline parm7.elf File opened for reading /proc/111cmdline parm7.elf File opened for reading /proc/111o/cmdline parm7.elf File opened for reading /proc/444cmdline parm7.elf File opened for reading /proc/555cmdline parm7.elf File opened for reading /proc/7777cmdline parm7.elf File opened for reading /proc/444/stat parm7.elf File opened for reading /proc/8888�;cmdline parm7.elf File opened for reading /proc/11cmdline parm7.elf File opened for reading /proc/33cmdline parm7.elf File opened for reading /proc/1111�1cmdline parm7.elf File opened for reading /proc/6666c7cmdline parm7.elf File opened for reading /proc/6666;cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/22/stat parm7.elf File opened for reading /proc/7777/stat parm7.elf File opened for reading /proc/333�/cmdline parm7.elf File opened for reading /proc/333s�/cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/66/stat parm7.elf File opened for reading /proc/555s�/cmdline parm7.elf File opened for reading /proc/3333=5cmdline parm7.elf File opened for reading /proc/6666[8cmdline parm7.elf File opened for reading /proc/11/stat parm7.elf File opened for reading /proc/111/stat parm7.elf File opened for reading /proc/77cmdline parm7.elf File opened for reading /proc/111cw/cmdline parm7.elf File opened for reading /proc/333s�/cmdline parm7.elf File opened for reading /proc/444d�/cmdline parm7.elf File opened for reading /proc/55cmdline parm7.elf File opened for reading /proc/777k�/cmdline parm7.elf File opened for reading /proc/2222t4cmdline parm7.elf