Analysis
- max time kernel
149s - max time network
139s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
15/07/2026, 03:17
Static task
static1
Behavioral task
behavioral1
Sample
204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7
Resource
debian12-armhf-20260513-en
debian-12-armhf
8 signatures
150 seconds
General
- Target 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7
- Size 493KB
- Sample260715-ds91eaax9j
- SHA256 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7
- MD5 c9250ccd4fb21a3e0b21adb02e7d7241
- SHA1 ba6e252f70a4dbd12f0640b32812fddc10366c17
- SHA512 5314224a3f7f9f43867460f50f9859a163ee36c21281aaf029585b2a914889a90748731f7bcc933804efcf47bfa348a3bd446d3bda6cd7b8f638b14918ed748c
- SSDEEP 6144:FPphw12rrEFY2dXQ7aAtlu4d/ck+5WOzU2B4T39MQnfpVlcH2/roLTZnH8Ugpjrw:FxFrIZQGN4d2Z5EtMsFcH2cCUgpjrVK
- TLSH T1C2B42859F880DFA1C6C12976F64D86AC73134779C3EBB20699145B343BAB86B0F3B605
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Contacts a large (1501) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for modification /dev/misc/watchdog 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 1 IoCs
description ioc Process File opened for modification /sbin/watchdog 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 - Reads process memory 1 TTPs 40 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/253/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/351/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/674/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/783/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/810/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/838/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/314/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/315/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/330/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/765/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/1/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/355/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/371/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/642/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/806/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/807/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/812/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/822/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/805/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/828/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/829/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/853/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/866/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/877/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/341/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/621/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/727/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/734/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/831/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/192/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/215/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/669/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/826/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/641/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/813/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/832/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/316/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/338/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/731/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/835/maps 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself 804 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 - Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/class/watchdog 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /sys/devices/virtual/misc/watchdog 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /sys/class/misc/watchdog 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 -
description ioc Process File opened for reading /proc/765/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/866/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/877/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/253/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/621/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/674/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/807/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/813/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/829/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/831/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/338/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/371/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/641/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/642/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/810/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/812/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/838/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/853/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/330/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/669/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/727/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/806/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/828/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/835/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/215/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/315/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/316/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/822/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/826/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/832/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/192/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/351/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/783/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/805/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/734/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/314/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/731/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/1/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/341/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7 File opened for reading /proc/355/exe 204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7
Processes
-
/tmp/204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae7/tmp/204e51b2bff7888306dd0a76d44dac80663c2bd8c7e8202a1651e966889c2ae71⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads process memory
- Changes its process name
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:804