General
- Target bot.armv7l
- Size 397KB
- Sample261001-pkfblsshqa
- SHA256 b09baf2470ed83268357311546aebb1fb0bc64cdc93195c92b95b62019d7778c
- MD5 79502edaa99034a93f3d19fd372c6290
- SHA1 3dae519d1a359ef5a7af729734706ade146ca971
- SHA512 2257ff92ae36c9b205dfa713f9796cd525edce434307c14ba1788f0efa6598e267b9b743bfef011d21942fca33c7edc5cec0c79c6f602504b66007cf9dc900e0
- SSDEEP 6144:CGlOHh72NgKIuBN1H47CrqFqIGyUzTpeSqTukRKDjfSHIqX0wqnNDmSv:XlOd4gKXr1YurqBGyUzIFTzRgS90w+v
- TLSH T1C8842B55FC80CA92C5D41B79FB6D434C33171B39D2EEB206CE159B3526EB88B0B7A582
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
bot.armv7l
Resource
debian12-armhf-20260127-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target bot.armv7l
- Size 397KB
- SHA256 b09baf2470ed83268357311546aebb1fb0bc64cdc93195c92b95b62019d7778c
- MD5 79502edaa99034a93f3d19fd372c6290
- SHA1 3dae519d1a359ef5a7af729734706ade146ca971
- SHA512 2257ff92ae36c9b205dfa713f9796cd525edce434307c14ba1788f0efa6598e267b9b743bfef011d21942fca33c7edc5cec0c79c6f602504b66007cf9dc900e0
- SSDEEP 6144:CGlOHh72NgKIuBN1H47CrqFqIGyUzTpeSqTukRKDjfSHIqX0wqnNDmSv:XlOd4gKXr1YurqBGyUzIFTzRgS90w+v
- TLSH T1C8842B55FC80CA92C5D41B79FB6D434C33171B39D2EEB206CE159B3526EB88B0B7A582
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Traces itself
Traces itself to prevent debugging attempts
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system