Analysis
- max time kernel
145s - max time network
150s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
13/06/2026, 00:15
Behavioral task
behavioral1
Sample
kkk.arm7k
Resource
debian12-armhf-20260513-en
debian-12-armhf
6 signatures
150 seconds
General
- Target kkk.arm7k
- Size 156KB
- Sample260613-ajxf6sds21
- SHA256 de18f7b2b5146893c8fc45001920b5b1b7fd5796545f238b4233b23eda60fca1
- MD5 04a0cf7114667773f70767508a157b66
- SHA1 e22d3a1ef81dfd15db995af5083a9d1f6b357fd2
- SHA512 a65768c49fc291015788899b2db6dd59966f579d176eade76a97cb4d4f4001c6abb630e62751d4c61acb14d168bc465fb2113db39adb07fbfacf8af06f278e5d
- SSDEEP 3072:WOSe6nN+6T9vJvfKca/kK6cU7hg6N7o9WTrI+vbkiM/9jyk4n:WOSe6nN+6T7Xta/kK6cUdgPCI+vb1M/e
- TLSH T12BF33B56FB418A13C0D62779BAAF424533239B64D3DB33069928BFB43F8679E0E63505
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog kkk.arm7k File opened for modification /dev/misc/watchdog kkk.arm7k - Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 781 kkk.arm7k - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 6 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/193/maps kkk.arm7k File opened for reading /proc/218/maps kkk.arm7k File opened for reading /proc/255/maps kkk.arm7k File opened for reading /proc/341/maps kkk.arm7k File opened for reading /proc/643/maps kkk.arm7k File opened for reading /proc/799/maps kkk.arm7k - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself mcpb31e1eb1idicnb 781 kkk.arm7k -
description ioc Process File opened for reading /proc/28/comm kkk.arm7k File opened for reading /proc/774/comm kkk.arm7k File opened for reading /proc/255/cmdline kkk.arm7k File opened for reading /proc/317/cmdline kkk.arm7k File opened for reading /proc/337/cmdline kkk.arm7k File opened for reading /proc/36/cmdline kkk.arm7k File opened for reading /proc/218/comm kkk.arm7k File opened for reading /proc/733/comm kkk.arm7k File opened for reading /proc/51/comm kkk.arm7k File opened for reading /proc/bus/comm kkk.arm7k File opened for reading /proc/1/comm kkk.arm7k File opened for reading /proc/44/comm kkk.arm7k File opened for reading /proc/316/comm kkk.arm7k File opened for reading /proc/785/comm kkk.arm7k File opened for reading /proc/782/cmdline kkk.arm7k File opened for reading /proc/30/cmdline kkk.arm7k File opened for reading /proc/677/cmdline kkk.arm7k File opened for reading /proc/27/comm kkk.arm7k File opened for reading /proc/42/comm kkk.arm7k File opened for reading /proc/33/cmdline kkk.arm7k File opened for reading /proc/142/cmdline kkk.arm7k File opened for reading /proc/761/cmdline kkk.arm7k File opened for reading /proc/irq/comm kkk.arm7k File opened for reading /proc/35/comm kkk.arm7k File opened for reading /proc/352/comm kkk.arm7k File opened for reading /proc/643/comm kkk.arm7k File opened for reading /proc/27/cmdline kkk.arm7k File opened for reading /proc/341/comm kkk.arm7k File opened for reading /proc/369/cmdline kkk.arm7k File opened for reading /proc/7/cmdline kkk.arm7k File opened for reading /proc/26/comm kkk.arm7k File opened for reading /proc/142/comm kkk.arm7k File opened for reading /proc/733/cmdline kkk.arm7k File opened for reading /proc/dynamic_debug/comm kkk.arm7k File opened for reading /proc/18/comm kkk.arm7k File opened for reading /proc/25/comm kkk.arm7k File opened for reading /proc/369/comm kkk.arm7k File opened for reading /proc/677/comm kkk.arm7k File opened for reading /proc/330/cmdline kkk.arm7k File opened for reading /proc/19/cmdline kkk.arm7k File opened for reading /proc/30/comm kkk.arm7k File opened for reading /proc/31/comm kkk.arm7k File opened for reading /proc/356/comm kkk.arm7k File opened for reading /proc/193/cmdline kkk.arm7k File opened for reading /proc/15/cmdline kkk.arm7k File opened for reading /proc/26/cmdline kkk.arm7k File opened for reading /proc/2/cmdline kkk.arm7k File opened for reading /proc/19/comm kkk.arm7k File opened for reading /proc/22/comm kkk.arm7k File opened for reading /proc/32/comm kkk.arm7k File opened for reading /proc/682/comm kkk.arm7k File opened for reading /proc/622/cmdline kkk.arm7k File opened for reading /proc/9/comm kkk.arm7k File opened for reading /proc/9/cmdline kkk.arm7k File opened for reading /proc/143/cmdline kkk.arm7k File opened for reading /proc/200/cmdline kkk.arm7k File opened for reading /proc/774/cmdline kkk.arm7k File opened for reading /proc/776/cmdline kkk.arm7k File opened for reading /proc/12/cmdline kkk.arm7k File opened for reading /proc/17/cmdline kkk.arm7k File opened for reading /proc/57/cmdline kkk.arm7k File opened for reading /proc/11/comm kkk.arm7k File opened for reading /proc/14/comm kkk.arm7k File opened for reading /proc/36/comm kkk.arm7k