Analysis
- max time kernel
148s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
26/08/2026, 05:39
Behavioral task
behavioral1
Sample
X86_64.elf
Resource
debian12-armhf-20260127-en
debian-12-armhf
6 signatures
150 seconds
General
- Target X86_64.elf
- Size 180KB
- Sample260826-gcdh2sgp21
- SHA256 5a21c34ff54ab1a92246b9cfba815ed187fe636b9350d41e26c5e4aa8f4bf891
- MD5 a3f170fe42e91ad7f9e6748e06fbf3ad
- SHA1 8979e463c89d8e139c8340a093898d1004522eb6
- SHA512 e3d6d412f17d8fe4eedb216ccade681db9618fff31481092b9864cc3846d0faa389f7811b893fa8150fb0396339b34fe21f9e972902587a91089814e68742f40
- SSDEEP 3072:5wj2cqrE/ZIaKKAkclJsqVshGP+ke+N/xM/9N+Iim6POmZho9NSf:5wj2fgxIaKKAkoJsvGP+ke+NpM/9N+RV
- TLSH T102044D25EA81CB53C1D21B79B69F424137239F65E3DB73069918BFB43FA275E0E22502
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 1 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog X86_64.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route X86_64.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/sbin/dropbear 775 X86_64.elf - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route X86_64.elf -
description ioc Process File opened for reading /proc/23/cmdline X86_64.elf File opened for reading /proc/44/cmdline X86_64.elf File opened for reading /proc/1624/cmdline X86_64.elf File opened for reading /proc/1734/cmdline X86_64.elf File opened for reading /proc/1954/cmdline X86_64.elf File opened for reading /proc/1536/cmdline X86_64.elf File opened for reading /proc/1580/cmdline X86_64.elf File opened for reading /proc/3/cmdline X86_64.elf File opened for reading /proc/26/cmdline X86_64.elf File opened for reading /proc/191/cmdline X86_64.elf File opened for reading /proc/633/cmdline X86_64.elf File opened for reading /proc/634/cmdline X86_64.elf File opened for reading /proc/783/cmdline X86_64.elf File opened for reading /proc/2/cmdline X86_64.elf File opened for reading /proc/16/cmdline X86_64.elf File opened for reading /proc/25/cmdline X86_64.elf File opened for reading /proc/351/cmdline X86_64.elf File opened for reading /proc/786/cmdline X86_64.elf File opened for reading /proc/1140/cmdline X86_64.elf File opened for reading /proc/1294/cmdline X86_64.elf File opened for reading /proc/1404/cmdline X86_64.elf File opened for reading /proc/328/cmdline X86_64.elf File opened for reading /proc/4/cmdline X86_64.elf File opened for reading /proc/57/cmdline X86_64.elf File opened for reading /proc/670/cmdline X86_64.elf File opened for reading /proc/1756/cmdline X86_64.elf File opened for reading /proc/1844/cmdline X86_64.elf File opened for reading /proc/1910/cmdline X86_64.elf File opened for reading /proc/2042/cmdline X86_64.elf File opened for reading /proc/7/cmdline X86_64.elf File opened for reading /proc/208/cmdline X86_64.elf File opened for reading /proc/1050/cmdline X86_64.elf File opened for reading /proc/1184/cmdline X86_64.elf File opened for reading /proc/1888/cmdline X86_64.elf File opened for reading /proc/2064/cmdline X86_64.elf File opened for reading /proc/2086/cmdline X86_64.elf File opened for reading /proc/29/cmdline X86_64.elf File opened for reading /proc/2328/cmdline X86_64.elf File opened for reading /proc/13/cmdline X86_64.elf File opened for reading /proc/34/cmdline X86_64.elf File opened for reading /proc/771/cmdline X86_64.elf File opened for reading /proc/940/cmdline X86_64.elf File opened for reading /proc/1866/cmdline X86_64.elf File opened for reading /proc/2108/cmdline X86_64.elf File opened for reading /proc/36/cmdline X86_64.elf File opened for reading /proc/984/cmdline X86_64.elf File opened for reading /proc/31/cmdline X86_64.elf File opened for reading /proc/51/cmdline X86_64.elf File opened for reading /proc/781/cmdline X86_64.elf File opened for reading /proc/874/cmdline X86_64.elf File opened for reading /proc/1448/cmdline X86_64.elf File opened for reading /proc/2240/cmdline X86_64.elf File opened for reading /proc/27/cmdline X86_64.elf File opened for reading /proc/46/cmdline X86_64.elf File opened for reading /proc/307/cmdline X86_64.elf File opened for reading /proc/2218/cmdline X86_64.elf File opened for reading /proc/2372/cmdline X86_64.elf File opened for reading /proc/1492/cmdline X86_64.elf File opened for reading /proc/10/cmdline X86_64.elf File opened for reading /proc/20/cmdline X86_64.elf File opened for reading /proc/362/cmdline X86_64.elf File opened for reading /proc/830/cmdline X86_64.elf File opened for reading /proc/1272/cmdline X86_64.elf File opened for reading /proc/1668/cmdline X86_64.elf