Analysis
- max time kernel
150s - max time network
153s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
20/06/2026, 03:47
Behavioral task
behavioral1
Sample
parm7.elf
Resource
debian12-armhf-20260127-en
debian-12-armhf
5 signatures
150 seconds
General
- Target parm7.elf
- Size 103KB
- Sample260620-echfwset2y
- SHA256 603afabe0bd67f9c66c1680b0e8c1c2d2b319053aeaf41a8b2380530ebf3719c
- MD5 94f63803e90efdac1dd00ebea1394d68
- SHA1 1b2d8b8a14197c288d74b4df032e53d8278a2987
- SHA512 ed222c2c231da73622c539adfcad21f8b6434413f01527050ec916616f3fd2b626d77872663dd59808ebb48fd6e68d423463759874350dda138eb7f4fe12f2c4
- SSDEEP 1536:dbYu2nL9yZ4CBDhH8Vx6mPkP9Ol1AmPogY/aWkC94AdLDZfjBUP9adYCTdR4z:dbi64qFH8FK9CJYiYdLDZfjB5X4z
- TLSH T141A302DB58C9EB92CF6955B9F131C991791D8F3820EDAA9200CD480F26F43839199BDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
MIRAI
Signatures
- Deletes itself 1 IoCs
pid Process 787 parm7.elf - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog parm7.elf File opened for modification /dev/misc/watchdog parm7.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself scanbot 787 parm7.elf -
description ioc Process File opened for reading /proc/8888cmdline parm7.elf File opened for reading /proc/8888/stat parm7.elf File opened for reading /proc/111cmdline parm7.elf File opened for reading /proc/111z/cmdline parm7.elf File opened for reading /proc/222v�/cmdline parm7.elf File opened for reading /proc/444d�/cmdline parm7.elf File opened for reading /proc/2222�3cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/99/stat parm7.elf File opened for reading /proc/111/stat parm7.elf File opened for reading /proc/66cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/7777cmdline parm7.elf File opened for reading /proc/8888�;cmdline parm7.elf File opened for reading /proc/8888�;cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/8888�;cmdline parm7.elf File opened for reading /proc/555cmdline parm7.elf File opened for reading /proc/2222w;cmdline parm7.elf File opened for reading /proc/8888�<cmdline parm7.elf File opened for reading /proc/333�/cmdline parm7.elf File opened for reading /proc/6666[7cmdline parm7.elf File opened for reading /proc/222/stat parm7.elf File opened for reading /proc/333/stat parm7.elf File opened for reading /proc/444/stat parm7.elf File opened for reading /proc/555/stat parm7.elf File opened for reading /proc/88880<cmdline parm7.elf File opened for reading /proc/8888=cmdline parm7.elf File opened for reading /proc/22cmdline parm7.elf File opened for reading /proc/111c�/cmdline parm7.elf File opened for reading /proc/333�/cmdline parm7.elf File opened for reading /proc/7777�:cmdline parm7.elf File opened for reading /proc/7777;cmdline parm7.elf File opened for reading /proc/7777[;cmdline parm7.elf File opened for reading /proc/8888�;cmdline parm7.elf File opened for reading /proc/8888�;cmdline parm7.elf File opened for reading /proc/3333�4cmdline parm7.elf File opened for reading /proc/6666�:cmdline parm7.elf File opened for reading /proc/222cmdline parm7.elf File opened for reading /proc/222�/cmdline parm7.elf File opened for reading /proc/222c�/cmdline parm7.elf File opened for reading /proc/8888�;cmdline parm7.elf File opened for reading /proc/8888�;cmdline parm7.elf File opened for reading /proc/8888/exe parm7.elf File opened for reading /proc/44cmdline parm7.elf File opened for reading /proc/1111u;cmdline parm7.elf File opened for reading /proc/3333�4cmdline parm7.elf File opened for reading /proc/3333J5cmdline parm7.elf File opened for reading /proc/66/stat parm7.elf File opened for reading /proc/77/stat parm7.elf File opened for reading /proc/8888�;cmdline parm7.elf File opened for reading /proc/6666~;cmdline parm7.elf File opened for reading /proc/222l�/cmdline parm7.elf File opened for reading /proc/1111�1cmdline parm7.elf File opened for reading /proc/2222v;cmdline parm7.elf File opened for reading /proc/2222/stat parm7.elf File opened for reading /proc/3333/stat parm7.elf File opened for reading /proc/8888�;cmdline parm7.elf File opened for reading /proc/99ssn/cmdline parm7.elf File opened for reading /proc/3333m4cmdline parm7.elf File opened for reading /proc/3333�4cmdline parm7.elf File opened for reading /proc/7777�;cmdline parm7.elf File opened for reading /proc/55/stat parm7.elf File opened for reading /proc/1111/stat parm7.elf