General
- Target kworkerd-softirq.elf
- Size 102KB
- Sample260620-grn84adt9q
- SHA256 5493b99616ac9ef5b8391505dc0e07544a74efd78f113331e6d536db39fb985c
- MD5 db5ceabf31f6fa9ded82bac337a21c45
- SHA1 0f2dffe446bc1d031f49ddba02e52df34e4543c6
- SHA512 1cf0d3aaf0d3378c4fa0f131eaff112e6746c75ee6f68223b388a7eb89f09f8d26a1ec3ce72ce042612699f449b61e8cc8b09bcc4dfce241fa5d6a7157804a72
- SSDEEP 3072:Cng01ewb5Wh5Oe52bnGGvaZ1KWeM/njaH:Cng2e7qesiWanKKI
- TLSH T12AA3123827DD584BE4B849B13124A12517BF5A20EBDA2FA765E88EE1CD070C77AF1317
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
kworkerd-softirq.elf
Resource
debian12-armhf-20260513-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target kworkerd-softirq.elf
- Size 102KB
- SHA256 5493b99616ac9ef5b8391505dc0e07544a74efd78f113331e6d536db39fb985c
- MD5 db5ceabf31f6fa9ded82bac337a21c45
- SHA1 0f2dffe446bc1d031f49ddba02e52df34e4543c6
- SHA512 1cf0d3aaf0d3378c4fa0f131eaff112e6746c75ee6f68223b388a7eb89f09f8d26a1ec3ce72ce042612699f449b61e8cc8b09bcc4dfce241fa5d6a7157804a72
- SSDEEP 3072:Cng01ewb5Wh5Oe52bnGGvaZ1KWeM/njaH:Cng2e7qesiWanKKI
- TLSH T12AA3123827DD584BE4B849B13124A12517BF5A20EBDA2FA765E88EE1CD070C77AF1317
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1