296895c01a1fed9a2e3f0695bcc65945860da1822e8ad757d1b48cec6b7ec6df

Analysis

max time kernel
132s
max time network
141s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
19/09/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
arm7.elf
Size 121KB
Sample260919-3ff91azvbv
SHA256 296895c01a1fed9a2e3f0695bcc65945860da1822e8ad757d1b48cec6b7ec6df
MD5 15a16db2d408cc1adc48b25a048963a2
SHA1 1209acc5842cfa23c0f965241bedb485f6d99f4e
SHA512 c0a198396ea6b1bd99d511d7ef6dee7573298ee3844501c7eef5cf7d306eeb21a0601a406a271335a96445dfb204e1dae80d71c0f1888021c08229858d17c648
SSDEEP 3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmPVO:LzhWutxBaORaebXQd+mzBzlkV
TLSH
T19CC33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	arm7.elf
File opened for modification	/dev/misc/watchdog	arm7.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	WUPndtrHiTdaOQkRQH	784	arm7.elf

/tmp/arm7.elf
/tmp/arm7.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
PID:784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads