96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435

Analysis

max time kernel
150s
max time network
9s
platform
debian-12_mipsel
resource
debian12-mipsel-20260513-en
resource tags

arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
09/08/2026, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
Size 74KB
Sample260809-qjcd1afm2w
SHA256 96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435
MD5 86743ea62dff8451270d3598db5a805e
SHA1 5451fb3711599fad7d04d9c60abac38eb9ab48a5
SHA512 30936247d2d39198fe758211d4c2213187330cfbabe4c7a56c9303ec2390e5aeac939673d898889b58568382bb944eeb12a8718f7841dfbfd1359ab5d75940c7
SSDEEP 1536:zJPEBmW5iNWqcGTKwnXHZ84OqdZerESta:zJPEB8NWq9fqqd0
TLSH
T17873A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for modification	/dev/misc/watchdog	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for modification	/bin/watchdog	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin

Reads runtime system information 17 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/811/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for reading	/proc/404/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for reading	/proc/407/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for reading	/proc/663/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for reading	/proc/698/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for reading	/proc/806/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for reading	/proc/433/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for reading	/proc/660/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for reading	/proc/703/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for reading	/proc/775/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for reading	/proc/679/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for reading	/proc/763/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for reading	/proc/678/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for reading	/proc/726/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for reading	/proc/781/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for reading	/proc/794/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
File opened for reading	/proc/795/cmdline	96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin

/tmp/96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
/tmp/96741f7e5bea4eee35f1fbc6810c5292d4d69739862c12b4d919e96e13e58435.bin
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:801

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads