Analysis
- max time kernel
0s - max time network
139s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
10/08/2026, 02:52
General
- Target arm7.elf
- Size 56KB
- Sample260810-dcwsvazdrd
- SHA256 3d9b27a3bf639f2e626b3b8dda083f263e1c0cf1e57bccb7a5ff40e8ff3b8191
- MD5 9cacc84da036a04955a69ec61d337943
- SHA1 0c43cfce829011713ba93e4a7d3b7a41eb57324e
- SHA512 445eb8876717db46200c791cc298f976bd690222aa14a378c69c9302c5e6b09ba8f4cf9e0f38adb8d9d349e7293fd33c0f3a76977b3f7fa665fcc473bd3a43e6
- SSDEEP 768:QjO6tY3QKoPlyzOwUwvjK83k25vY3M+5+fob402y+Nz4Pq3UIFrEUnnIxJ8632Sa:T6GtoNGvWOY8/fBfy+Ncgp1d6TMXP
- TLSH T12043F232D19B3658A3D01C3FDE7D0D87608732B646B627C41A3B011DBE5278F9D698A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
mirai
Botnet
-
MIRAI
Signatures
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp arm7.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp arm7.elf -
description ioc Process File opened for reading /proc/16/cmdline arm7.elf File opened for reading /proc/17/cmdline arm7.elf File opened for reading /proc/680/cmdline arm7.elf File opened for reading /proc/732/cmdline arm7.elf File opened for reading /proc/782/cmdline arm7.elf File opened for reading /proc/816/cmdline arm7.elf File opened for reading /proc/3/cmdline arm7.elf File opened for reading /proc/14/cmdline arm7.elf File opened for reading /proc/25/cmdline arm7.elf File opened for reading /proc/56/cmdline arm7.elf File opened for reading /proc/806/fd arm7.elf File opened for reading /proc/23/cmdline arm7.elf File opened for reading /proc/42/cmdline arm7.elf File opened for reading /proc/44/cmdline arm7.elf File opened for reading /proc/141/cmdline arm7.elf File opened for reading /proc/252/cmdline arm7.elf File opened for reading /proc/674/cmdline arm7.elf File opened for reading /proc/216/cmdline arm7.elf File opened for reading /proc/26/cmdline arm7.elf File opened for reading /proc/34/cmdline arm7.elf File opened for reading /proc/806/cmdline arm7.elf File opened for reading /proc/811/cmdline arm7.elf File opened for reading /proc/6/cmdline arm7.elf File opened for reading /proc/15/cmdline arm7.elf File opened for reading /proc/27/cmdline arm7.elf File opened for reading /proc/379/cmdline arm7.elf File opened for reading /proc/817/cmdline arm7.elf File opened for reading /proc/5/cmdline arm7.elf File opened for reading /proc/36/cmdline arm7.elf File opened for reading /proc/8/cmdline arm7.elf File opened for reading /proc/51/cmdline arm7.elf File opened for reading /proc/337/cmdline arm7.elf File opened for reading /proc/363/cmdline arm7.elf File opened for reading /proc/1/cmdline arm7.elf File opened for reading /proc/7/cmdline arm7.elf File opened for reading /proc/21/cmdline arm7.elf File opened for reading /proc/345/cmdline arm7.elf File opened for reading /proc/360/cmdline arm7.elf File opened for reading /proc/620/cmdline arm7.elf File opened for reading /proc/800/cmdline arm7.elf File opened for reading /proc/808/cmdline arm7.elf File opened for reading /proc/10/cmdline arm7.elf File opened for reading /proc/799/cmdline arm7.elf File opened for reading /proc/317/cmdline arm7.elf File opened for reading /proc/4/cmdline arm7.elf File opened for reading /proc/46/cmdline arm7.elf File opened for reading /proc/73/cmdline arm7.elf File opened for reading /proc/725/cmdline arm7.elf File opened for reading /proc/196/cmdline arm7.elf File opened for reading /proc/2/cmdline arm7.elf File opened for reading /proc/18/cmdline arm7.elf File opened for reading /proc/22/cmdline arm7.elf File opened for reading /proc/29/cmdline arm7.elf File opened for reading /proc/32/cmdline arm7.elf File opened for reading /proc/33/cmdline arm7.elf File opened for reading /proc/639/cmdline arm7.elf File opened for reading /proc/9/cmdline arm7.elf File opened for reading /proc/11/cmdline arm7.elf File opened for reading /proc/19/cmdline arm7.elf File opened for reading /proc/20/cmdline arm7.elf File opened for reading /proc/24/cmdline arm7.elf File opened for reading /proc/30/cmdline arm7.elf File opened for reading /proc/31/cmdline arm7.elf File opened for reading /proc/35/cmdline arm7.elf