General
- Target bot.arm5.elf
- Size 232KB
- Sample260919-1be52aca69
- SHA256 96d1828a79f41ec92649ff064cc7b1850ae2d2b31b5f773a2cf63345e944be21
- MD5 c7765dbe0676302b090df912502bfa7e
- SHA1 eb20304e7ec5252668d4e469d68ec7451f8cf12b
- SHA512 b9393db645259d68b9cdff6b98fcaf3de489773d36ea87fe778a913b5330b7ed1acea0a330eddefd51860d689afae11aed612ca49a76916a606adcf37a4370fd
- SSDEEP 6144:u40OOMZSx5KN/kXyQR/A9wdZbsDfJLujcYMrqkzBiHI:n0OO5x5KN/kXyQR/AyHsDhijsqqF
- TLSH T164340865F880DBE2C6C02B7AFB5D834C73131B78D6DEB102DD156B2536FA84A4E7A442
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
bot.arm5.elf
Resource
debian12-armhf-20260513-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target bot.arm5.elf
- Size 232KB
- SHA256 96d1828a79f41ec92649ff064cc7b1850ae2d2b31b5f773a2cf63345e944be21
- MD5 c7765dbe0676302b090df912502bfa7e
- SHA1 eb20304e7ec5252668d4e469d68ec7451f8cf12b
- SHA512 b9393db645259d68b9cdff6b98fcaf3de489773d36ea87fe778a913b5330b7ed1acea0a330eddefd51860d689afae11aed612ca49a76916a606adcf37a4370fd
- SSDEEP 6144:u40OOMZSx5KN/kXyQR/A9wdZbsDfJLujcYMrqkzBiHI:n0OO5x5KN/kXyQR/AyHsDhijsqqF
- TLSH T164340865F880DBE2C6C02B7AFB5D834C73131B78D6DEB102DD156B2536FA84A4E7A442
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Traces itself
Traces itself to prevent debugging attempts
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system