Analysis
- max time kernel
140s - max time network
138s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
09/08/2026, 10:15
Behavioral task
behavioral1
Sample
lkxstress.arm7.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
5 signatures
150 seconds
General
- Target lkxstress.arm7.elf
- Size 85KB
- Sample260809-mapq7awara
- SHA256 e0f7f947bcbb8290bf676d0d8a8b9be4dc2821c3ab31c1badfb34501421948ed
- MD5 eabd156df2bb0c1cd88d119225037177
- SHA1 d7ba2caaf321b68f2110c61c6ccdb699eb74dc02
- SHA512 53c39093516f4bdb4269c4da2eadbaffa5a248f5f3c7e963882bed445b7a2f0a6b1997e9197125708c60925ead6b64fc570cde382e33ebfa0fbc219479d35460
- SSDEEP 1536:lm53mISURa0LDba+LglaawdJtoObKyKGswlYGCmlL/RQOxQBTVg79DvR61g/VqpC:C3DSURBLDVLEidJ6ObMG/dCmlLGOxQnC
- TLSH T16483023A79B8535A98AE24BC76AF118DA29769FCB53F1C9A3F6C1950C3314D33774202
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog lkxstress.arm7.elf File opened for modification /dev/misc/watchdog lkxstress.arm7.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog lkxstress.arm7.elf File opened for modification /bin/watchdog lkxstress.arm7.elf -
description ioc Process File opened for reading /proc/27/status lkxstress.arm7.elf File opened for reading /proc/44/status lkxstress.arm7.elf File opened for reading /proc/56/status lkxstress.arm7.elf File opened for reading /proc/726/status lkxstress.arm7.elf File opened for reading /proc/216/status lkxstress.arm7.elf File opened for reading /proc/1/status lkxstress.arm7.elf File opened for reading /proc/19/status lkxstress.arm7.elf File opened for reading /proc/29/status lkxstress.arm7.elf File opened for reading /proc/31/status lkxstress.arm7.elf File opened for reading /proc/732/status lkxstress.arm7.elf File opened for reading /proc/2/status lkxstress.arm7.elf File opened for reading /proc/33/status lkxstress.arm7.elf File opened for reading /proc/36/status lkxstress.arm7.elf File opened for reading /proc/379/status lkxstress.arm7.elf File opened for reading /proc/729/status lkxstress.arm7.elf File opened for reading /proc/17/status lkxstress.arm7.elf File opened for reading /proc/51/status lkxstress.arm7.elf File opened for reading /proc/4/status lkxstress.arm7.elf File opened for reading /proc/341/status lkxstress.arm7.elf File opened for reading /proc/674/status lkxstress.arm7.elf File opened for reading /proc/42/status lkxstress.arm7.elf File opened for reading /proc/140/status lkxstress.arm7.elf File opened for reading /proc/765/status lkxstress.arm7.elf File opened for reading /proc/780/status lkxstress.arm7.elf File opened for reading /proc/8/status lkxstress.arm7.elf File opened for reading /proc/785/status lkxstress.arm7.elf File opened for reading /proc/793/status lkxstress.arm7.elf File opened for reading /proc/5/status lkxstress.arm7.elf File opened for reading /proc/22/status lkxstress.arm7.elf File opened for reading /proc/45/status lkxstress.arm7.elf File opened for reading /proc/252/status lkxstress.arm7.elf File opened for reading /proc/317/status lkxstress.arm7.elf File opened for reading /proc/360/status lkxstress.arm7.elf File opened for reading /proc/789/status lkxstress.arm7.elf File opened for reading /proc/12/status lkxstress.arm7.elf File opened for reading /proc/28/status lkxstress.arm7.elf File opened for reading /proc/790/status lkxstress.arm7.elf File opened for reading /proc/337/status lkxstress.arm7.elf File opened for reading /proc/21/status lkxstress.arm7.elf File opened for reading /proc/26/status lkxstress.arm7.elf File opened for reading /proc/196/status lkxstress.arm7.elf File opened for reading /proc/198/status lkxstress.arm7.elf File opened for reading /proc/6/status lkxstress.arm7.elf File opened for reading /proc/7/status lkxstress.arm7.elf File opened for reading /proc/9/status lkxstress.arm7.elf File opened for reading /proc/14/status lkxstress.arm7.elf File opened for reading /proc/15/status lkxstress.arm7.elf File opened for reading /proc/32/status lkxstress.arm7.elf File opened for reading /proc/46/status lkxstress.arm7.elf File opened for reading /proc/311/status lkxstress.arm7.elf File opened for reading /proc/23/status lkxstress.arm7.elf File opened for reading /proc/25/status lkxstress.arm7.elf File opened for reading /proc/34/status lkxstress.arm7.elf File opened for reading /proc/73/status lkxstress.arm7.elf File opened for reading /proc/680/status lkxstress.arm7.elf File opened for reading /proc/784/status lkxstress.arm7.elf File opened for reading /proc/self/exe lkxstress.arm7.elf File opened for reading /proc/13/status lkxstress.arm7.elf File opened for reading /proc/345/status lkxstress.arm7.elf File opened for reading /proc/639/status lkxstress.arm7.elf File opened for reading /proc/640/status lkxstress.arm7.elf File opened for reading /proc/3/status lkxstress.arm7.elf File opened for reading /proc/16/status lkxstress.arm7.elf File opened for reading /proc/20/status lkxstress.arm7.elf