Analysis
- max time kernel
149s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
14/08/2026, 17:08
Behavioral task
behavioral1
Sample
849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5
Resource
debian12-armhf-20260513-en
debian-12-armhf
8 signatures
150 seconds
General
- Target 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5
- Size 194KB
- Sample260814-vnpx4seq2z
- SHA256 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5
- MD5 169457a3e60db046e2f67d5b1ecd0693
- SHA1 0fc1594c8a32aede708f1855c06ee9c9d65b02ab
- SHA512 7541538e325e250b3647e221de1dd27af74f04de5624b93d17e4b4fd9bb4aaecaa1012a6c97e224ea8c9262935385294006ceee2af457b491cd984411464c538
- SSDEEP 6144:ZA4V6IO2l5gP3HbHQw4DaAnjKc4VjL2Fin6M/9ZsuBwMWDM:ZFV6I+DQw4DaAnjKc4kgz/7FBwA
- TLSH T126143B46AA408F13C4D6277AFBAF424533339B64D3DB730599286FB43B8679E4E72502
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Contacts a large (57597) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for modification /dev/misc/watchdog 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 - Renames itself 1 IoCs
pid Process 784 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 - Unexpected DNS network traffic destination 8 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.220.220 - Reads process memory 1 TTPs 13 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/88/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/111/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/333/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/33/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/77/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/222/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/444/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/555/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/11/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/22/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/44/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/55/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/66/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself upnpc-static 784 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 -
description ioc Process File opened for reading /proc/333�/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/2222�3/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/3333fffffff/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/111f/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/333s�/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/555s�/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/7777�;/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/8888�;/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/222�/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/222z/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/2222U4/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/3333Y5/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/6666O8/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/7777�;/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/7777/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/1111�;/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/3333�;/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/6666f8/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/8888/cmdline 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/333�/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/444d�/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/7777�;/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/7777�;/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/8888�;/cmdline 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/99ssd/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/111cv/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/1111�;/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/6666�:/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/1111�1/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/77775;/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/111cx/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/222v�/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/3333c4/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/3333z4/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/6666d7/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/7777~;/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/333s�/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/3333�4/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/6666K7/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/222c�/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/3333�4/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/111p/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/222l�/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/7777�;/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/self/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/8888�;/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/1111�/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/7777�;/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/777k�/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/7777';/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/7777�;/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/8888�;/cmdline 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/111un/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/222m�/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/3333�4/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/mounts 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/8888/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/1111�2/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/3333=5/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5 File opened for reading /proc/3333I5/maps 849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5