Analysis
- max time kernel
145s - max time network
145s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
04/08/2026, 05:36
Behavioral task
behavioral1
Sample
nz.arm7.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target nz.arm7.elf
- Size 205KB
- Sample260804-garmwsdf99
- SHA256 da32367c5b5692d75d4401de1d3df93ee50913a58c8c513ce5317c7025c6617c
- MD5 c68983cf0db61ab35e7ce95c051ba47c
- SHA1 9adc47763190fb40eb26c86bb58ffe3b1d64d72e
- SHA512 04809dc39421498a44633974545d76ab31bc111e59d2ce2dd520bc83f9f109e1ac2bc3d240b2d121b58fcd42596a3210923cb168c4ed955d97400bddaaa3d801
- SSDEEP 6144:zFOUinDLZ+akkDDdYn4txaCGtLHmtLl9M/9P1s:zFOUiDLZ+akkDDdYn4DaHYXK/E
- TLSH T1D6245C46EA814E23C4D71779B6AF114A333297A4D3DB730689286FB43BC679F0D63A05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.arm7.elf File opened for modification /dev/misc/watchdog nz.arm7.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /bin/watchdog nz.arm7.elf File opened for modification /sbin/watchdog nz.arm7.elf -
description ioc Process File opened for reading /proc/773/status nz.arm7.elf File opened for reading /proc/777/status nz.arm7.elf File opened for reading /proc/15/status nz.arm7.elf File opened for reading /proc/16/status nz.arm7.elf File opened for reading /proc/18/status nz.arm7.elf File opened for reading /proc/21/status nz.arm7.elf File opened for reading /proc/42/status nz.arm7.elf File opened for reading /proc/355/status nz.arm7.elf File opened for reading /proc/367/status nz.arm7.elf File opened for reading /proc/638/status nz.arm7.elf File opened for reading /proc/31/status nz.arm7.elf File opened for reading /proc/35/status nz.arm7.elf File opened for reading /proc/44/status nz.arm7.elf File opened for reading /proc/313/status nz.arm7.elf File opened for reading /proc/668/status nz.arm7.elf File opened for reading /proc/724/status nz.arm7.elf File opened for reading /proc/6/status nz.arm7.elf File opened for reading /proc/11/status nz.arm7.elf File opened for reading /proc/20/status nz.arm7.elf File opened for reading /proc/193/status nz.arm7.elf File opened for reading /proc/315/status nz.arm7.elf File opened for reading /proc/2/status nz.arm7.elf File opened for reading /proc/14/status nz.arm7.elf File opened for reading /proc/34/status nz.arm7.elf File opened for reading /proc/340/status nz.arm7.elf File opened for reading /proc/722/status nz.arm7.elf File opened for reading /proc/783/status nz.arm7.elf File opened for reading /proc/4/status nz.arm7.elf File opened for reading /proc/26/status nz.arm7.elf File opened for reading /proc/51/status nz.arm7.elf File opened for reading /proc/316/status nz.arm7.elf File opened for reading /proc/29/status nz.arm7.elf File opened for reading /proc/33/status nz.arm7.elf File opened for reading /proc/759/status nz.arm7.elf File opened for reading /proc/24/status nz.arm7.elf File opened for reading /proc/25/status nz.arm7.elf File opened for reading /proc/312/status nz.arm7.elf File opened for reading /proc/359/status nz.arm7.elf File opened for reading /proc/779/status nz.arm7.elf File opened for reading /proc/30/status nz.arm7.elf File opened for reading /proc/32/status nz.arm7.elf File opened for reading /proc/45/status nz.arm7.elf File opened for reading /proc/46/status nz.arm7.elf File opened for reading /proc/143/status nz.arm7.elf File opened for reading /proc/216/status nz.arm7.elf File opened for reading /proc/613/status nz.arm7.elf File opened for reading /proc/781/status nz.arm7.elf File opened for reading /proc/1/status nz.arm7.elf File opened for reading /proc/23/status nz.arm7.elf File opened for reading /proc/254/status nz.arm7.elf File opened for reading /proc/8/status nz.arm7.elf File opened for reading /proc/17/status nz.arm7.elf File opened for reading /proc/22/status nz.arm7.elf File opened for reading /proc/330/status nz.arm7.elf File opened for reading /proc/10/status nz.arm7.elf File opened for reading /proc/12/status nz.arm7.elf File opened for reading /proc/782/status nz.arm7.elf File opened for reading /proc/7/status nz.arm7.elf File opened for reading /proc/13/status nz.arm7.elf File opened for reading /proc/28/status nz.arm7.elf File opened for reading /proc/36/status nz.arm7.elf File opened for reading /proc/198/status nz.arm7.elf File opened for reading /proc/615/status nz.arm7.elf File opened for reading /proc/772/status nz.arm7.elf