a9806bf3bcab0a102b0276920752216841cca4e23c42b68e5553b997a9146fd3

Analysis

max time kernel
0s
max time network
152s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
09/09/2026, 07:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
miraint.arm.elf
Size 522KB
Sample260909-h4266acq21
SHA256 a9806bf3bcab0a102b0276920752216841cca4e23c42b68e5553b997a9146fd3
MD5 5b2d3cc87c5169d4de4873e27c76b3c7
SHA1 9bf5435cb26f46e6da29921d5329b043a2b035d6
SHA512 c0c88936fb1a17fe83e2cbfc604f8527eb0e8cf995a8a8a10de16949f523da014d0bbc58b5f84a569c3cf42736519c2bf48cc76438a97577a90476d68f94b497
SSDEEP 12288:Zf9PnZWX0CTi7HojJMKFyGZO6JmFNfjpZY4vU/I04+43:5WX0CTNm3LzU/b4+4
TLSH
T10CB44A45F8819F52C9C136BAF75F4258732B47A9D3EA71029D189B383BCB95E0F3A601
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
780	miraint.arm.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	miraint.arm.elf
File opened for modification	/dev/misc/watchdog	miraint.arm.elf

/tmp/miraint.arm.elf
/tmp/miraint.arm.elf
1⤵
- Deletes itself
- Modifies Watchdog functionality
PID:780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads