Analysis
- max time kernel
150s - max time network
142s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
04/08/2026, 06:12
Behavioral task
behavioral1
Sample
parm7
Resource
debian12-armhf-20260127-en
debian-12-armhf
5 signatures
150 seconds
General
- Target parm7
- Size 103KB
- Sample260804-gymnvasfpc
- SHA256 603afabe0bd67f9c66c1680b0e8c1c2d2b319053aeaf41a8b2380530ebf3719c
- MD5 94f63803e90efdac1dd00ebea1394d68
- SHA1 1b2d8b8a14197c288d74b4df032e53d8278a2987
- SHA512 ed222c2c231da73622c539adfcad21f8b6434413f01527050ec916616f3fd2b626d77872663dd59808ebb48fd6e68d423463759874350dda138eb7f4fe12f2c4
- SSDEEP 1536:dbYu2nL9yZ4CBDhH8Vx6mPkP9Ol1AmPogY/aWkC94AdLDZfjBUP9adYCTdR4z:dbi64qFH8FK9CJYiYdLDZfjB5X4z
- TLSH T141A302DB58C9EB92CF6955B9F131C991791D8F3820EDAA9200CD480F26F43839199BDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
MIRAI
C2
-
89.32.41.16
Signatures
- Deletes itself 1 IoCs
pid Process 787 parm7 - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog parm7 File opened for modification /dev/misc/watchdog parm7 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself scanbot 787 parm7 -
description ioc Process File opened for reading /proc/111c�/cmdline parm7 File opened for reading /proc/2222q;cmdline parm7 File opened for reading /proc/7777z;cmdline parm7 File opened for reading /proc/44/stat parm7 File opened for reading /proc/7777�;cmdline parm7 File opened for reading /proc/6666/stat parm7 File opened for reading /proc/8888�;cmdline parm7 File opened for reading /proc/33cmdline parm7 File opened for reading /proc/44cmdline parm7 File opened for reading /proc/99ssn/cmdline parm7 File opened for reading /proc/222�/cmdline parm7 File opened for reading /proc/2222�3cmdline parm7 File opened for reading /proc/88/stat parm7 File opened for reading /proc/1111/stat parm7 File opened for reading /proc/8888cmdline parm7 File opened for reading /proc/1111�/cmdline parm7 File opened for reading /proc/6666M8cmdline parm7 File opened for reading /proc/7777};cmdline parm7 File opened for reading /proc/7777;cmdline parm7 File opened for reading /proc/8888�;cmdline parm7 File opened for reading /proc/111p/cmdline parm7 File opened for reading /proc/111ux/cmdline parm7 File opened for reading /proc/444cmdline parm7 File opened for reading /proc/33335cmdline parm7 File opened for reading /proc/7777U;cmdline parm7 File opened for reading /proc/7777�;cmdline parm7 File opened for reading /proc/8888/exe parm7 File opened for reading /proc/11cmdline parm7 File opened for reading /proc/66cmdline parm7 File opened for reading /proc/222�/cmdline parm7 File opened for reading /proc/555s�/cmdline parm7 File opened for reading /proc/2222fffffffcmdline parm7 File opened for reading /proc/3333\5cmdline parm7 File opened for reading /proc/3333w;cmdline parm7 File opened for reading /proc/7777y;cmdline parm7 File opened for reading /proc/22cmdline parm7 File opened for reading /proc/111cmdline parm7 File opened for reading /proc/222cmdline parm7 File opened for reading /proc/222m�/cmdline parm7 File opened for reading /proc/333�/cmdline parm7 File opened for reading /proc/6666s7cmdline parm7 File opened for reading /proc/11/stat parm7 File opened for reading /proc/55/stat parm7 File opened for reading /proc/222v�/cmdline parm7 File opened for reading /proc/77/stat parm7 File opened for reading /proc/111/stat parm7 File opened for reading /proc/222/stat parm7 File opened for reading /proc/2222/stat parm7 File opened for reading /proc/7777�;cmdline parm7 File opened for reading /proc/8888�;cmdline parm7 File opened for reading /proc/333s�/cmdline parm7 File opened for reading /proc/555cmdline parm7 File opened for reading /proc/3333?5cmdline parm7 File opened for reading /proc/66/stat parm7 File opened for reading /proc/99/stat parm7 File opened for reading /proc/333/stat parm7 File opened for reading /proc/7777/stat parm7 File opened for reading /proc/8888�;cmdline parm7 File opened for reading /proc/6666d8cmdline parm7 File opened for reading /proc/111z/cmdline parm7 File opened for reading /proc/2222o;cmdline parm7 File opened for reading /proc/3333�4cmdline parm7 File opened for reading /proc/777/stat parm7 File opened for reading /proc/222l�/cmdline parm7