Analysis
- max time kernel
148s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
21/09/2026, 01:05
Behavioral task
behavioral1
Sample
Space.arm7.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target Space.arm7.elf
- Size 155KB
- Sample260921-bfpgtsgp5w
- SHA256 a031852c5688f26aab531cca341576bc1098727320199e0f5bb3bd2a6caff94b
- MD5 1e2f8602fdfdbc0ad783829d18a06c90
- SHA1 04aa03063f92c71b0c5e430767d122f889cc16bf
- SHA512 8a05ee4c04012d70e9cfaeaf5731682541911123be5a6656cfa3296c07cc30af296597ff1488decbbf9fd276a4d0d2b0c4a95f378129457d31b1ef61977a3b05
- SSDEEP 3072:62bmltngzA0BJaq/xGP40Gv/KYZ+W9L6MjccDjyoM/9Hc03:pbmltSJaq/xGPu/H+wL6OccDj1M/9803
- TLSH T183F33A46F6418B13C0D61779BA9F424533239BA4E3DB73069928BFF43F8279A0E67905
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog Space.arm7.elf File opened for modification /dev/watchdog Space.arm7.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Space.arm7.elf File opened for modification /bin/watchdog Space.arm7.elf -
description ioc Process File opened for reading /proc/46/status Space.arm7.elf File opened for reading /proc/676/status Space.arm7.elf File opened for reading /proc/681/status Space.arm7.elf File opened for reading /proc/787/status Space.arm7.elf File opened for reading /proc/44/status Space.arm7.elf File opened for reading /proc/763/status Space.arm7.elf File opened for reading /proc/8/status Space.arm7.elf File opened for reading /proc/9/status Space.arm7.elf File opened for reading /proc/19/status Space.arm7.elf File opened for reading /proc/23/status Space.arm7.elf File opened for reading /proc/30/status Space.arm7.elf File opened for reading /proc/32/status Space.arm7.elf File opened for reading /proc/57/status Space.arm7.elf File opened for reading /proc/73/status Space.arm7.elf File opened for reading /proc/625/status Space.arm7.elf File opened for reading /proc/5/status Space.arm7.elf File opened for reading /proc/14/status Space.arm7.elf File opened for reading /proc/28/status Space.arm7.elf File opened for reading /proc/36/status Space.arm7.elf File opened for reading /proc/246/status Space.arm7.elf File opened for reading /proc/353/status Space.arm7.elf File opened for reading /proc/729/status Space.arm7.elf File opened for reading /proc/3/status Space.arm7.elf File opened for reading /proc/42/status Space.arm7.elf File opened for reading /proc/216/status Space.arm7.elf File opened for reading /proc/339/status Space.arm7.elf File opened for reading /proc/370/status Space.arm7.elf File opened for reading /proc/622/status Space.arm7.elf File opened for reading /proc/793/status Space.arm7.elf File opened for reading /proc/11/status Space.arm7.elf File opened for reading /proc/26/status Space.arm7.elf File opened for reading /proc/643/status Space.arm7.elf File opened for reading /proc/785/status Space.arm7.elf File opened for reading /proc/7/status Space.arm7.elf File opened for reading /proc/17/status Space.arm7.elf File opened for reading /proc/313/status Space.arm7.elf File opened for reading /proc/333/status Space.arm7.elf File opened for reading /proc/775/status Space.arm7.elf File opened for reading /proc/10/status Space.arm7.elf File opened for reading /proc/29/status Space.arm7.elf File opened for reading /proc/34/status Space.arm7.elf File opened for reading /proc/4/status Space.arm7.elf File opened for reading /proc/16/status Space.arm7.elf File opened for reading /proc/22/status Space.arm7.elf File opened for reading /proc/35/status Space.arm7.elf File opened for reading /proc/51/status Space.arm7.elf File opened for reading /proc/56/status Space.arm7.elf File opened for reading /proc/315/status Space.arm7.elf File opened for reading /proc/780/status Space.arm7.elf File opened for reading /proc/27/status Space.arm7.elf File opened for reading /proc/342/status Space.arm7.elf File opened for reading /proc/783/status Space.arm7.elf File opened for reading /proc/13/status Space.arm7.elf File opened for reading /proc/21/status Space.arm7.elf File opened for reading /proc/12/status Space.arm7.elf File opened for reading /proc/20/status Space.arm7.elf File opened for reading /proc/24/status Space.arm7.elf File opened for reading /proc/143/status Space.arm7.elf File opened for reading /proc/197/status Space.arm7.elf File opened for reading /proc/317/status Space.arm7.elf File opened for reading /proc/358/status Space.arm7.elf File opened for reading /proc/642/status Space.arm7.elf File opened for reading /proc/31/status Space.arm7.elf File opened for reading /proc/33/status Space.arm7.elf