b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b

Analysis

max time kernel
149s
max time network
135s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
09/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
Size 126KB
Sample260809-vtthgssepb
SHA256 b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b
MD5 06b69f2887af4c99777a57bc58ff7a39
SHA1 36da188abb334b2a995412280373faee0ddbb77e
SHA512 0834856469a05aab5f5573aa1335e7f73a4c8db1ff2af4b0d7545d14d1042fba6b01334a8bbf6462ff377243740441fd17d080020157d8f36777f65ba41f7411
SSDEEP 3072:cowpuQyNSG2eRa1styK9flTQPHoMrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIMrSmM/9nd
TLSH
T10FC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
File opened for modification	/dev/misc/watchdog	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
File opened for modification	/bin/watchdog	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin

Reads runtime system information 13 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/674/cmdline	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
File opened for reading	/proc/728/cmdline	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
File opened for reading	/proc/769/cmdline	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
File opened for reading	/proc/786/cmdline	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
File opened for reading	/proc/402/cmdline	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
File opened for reading	/proc/680/cmdline	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
File opened for reading	/proc/787/cmdline	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
File opened for reading	/proc/794/cmdline	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
File opened for reading	/proc/803/cmdline	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
File opened for reading	/proc/622/cmdline	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
File opened for reading	/proc/624/cmdline	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
File opened for reading	/proc/642/cmdline	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
File opened for reading	/proc/643/cmdline	b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin

/tmp/b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
/tmp/b4a7aaae50bc313514e16ec37f8c7985578fbf1928db84fea6153454d301970b.bin
1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads