b09baf2470ed83268357311546aebb1fb0bc64cdc93195c92b95b62019d7778c

Analysis

max time kernel
149s
max time network
153s
platform
debian-12_armhf
resource
debian12-armhf-20260127-en
resource tags

arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
01/10/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bot.armv7l
Size 397KB
Sample261001-pkfblsshqa
SHA256 b09baf2470ed83268357311546aebb1fb0bc64cdc93195c92b95b62019d7778c
MD5 79502edaa99034a93f3d19fd372c6290
SHA1 3dae519d1a359ef5a7af729734706ade146ca971
SHA512 2257ff92ae36c9b205dfa713f9796cd525edce434307c14ba1788f0efa6598e267b9b743bfef011d21942fca33c7edc5cec0c79c6f602504b66007cf9dc900e0
SSDEEP 6144:CGlOHh72NgKIuBN1H47CrqFqIGyUzTpeSqTukRKDjfSHIqX0wqnNDmSv:XlOd4gKXr1YurqBGyUzIFTzRgS90w+v
TLSH
T1C8842B55FC80CA92C5D41B79FB6D434C33171B39D2EEB206CE159B3526EB88B0B7A582
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
781	bot.armv7l

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	bot.armv7l
File opened for modification	/dev/misc/watchdog	bot.armv7l

Traces itself 2 IoCs

Traces itself to prevent debugging attempts

pid	Process
781	bot.armv7l
781	bot.armv7l

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/root	bot.armv7l

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	qo41rwdku7gursugdw1g	781	bot.armv7l

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/45/cmdline	bot.armv7l
File opened for reading	/proc/345/cmdline	bot.armv7l
File opened for reading	/proc/731/comm	bot.armv7l
File opened for reading	/proc/12/comm	bot.armv7l
File opened for reading	/proc/19/comm	bot.armv7l
File opened for reading	/proc/51/cmdline	bot.armv7l
File opened for reading	/proc/734/comm	bot.armv7l
File opened for reading	/proc/814/exe	bot.armv7l
File opened for reading	/proc/16/comm	bot.armv7l
File opened for reading	/proc/24/comm	bot.armv7l
File opened for reading	/proc/764/comm	bot.armv7l
File opened for reading	/proc/784/comm	bot.armv7l
File opened for reading	/proc/313/cmdline	bot.armv7l
File opened for reading	/proc/319/comm	bot.armv7l
File opened for reading	/proc/27/comm	bot.armv7l
File opened for reading	/proc/21/comm	bot.armv7l
File opened for reading	/proc/28/cmdline	bot.armv7l
File opened for reading	/proc/30/cmdline	bot.armv7l
File opened for reading	/proc/143/cmdline	bot.armv7l
File opened for reading	/proc/813/exe	bot.armv7l
File opened for reading	/proc/4/comm	bot.armv7l
File opened for reading	/proc/21/cmdline	bot.armv7l
File opened for reading	/proc/23/cmdline	bot.armv7l
File opened for reading	/proc/73/comm	bot.armv7l
File opened for reading	/proc/198/cmdline	bot.armv7l
File opened for reading	/proc/643/comm	bot.armv7l
File opened for reading	/proc/1/cmdline	bot.armv7l
File opened for reading	/proc/11/comm	bot.armv7l
File opened for reading	/proc/25/cmdline	bot.armv7l
File opened for reading	/proc/777/cmdline	bot.armv7l
File opened for reading	/proc/642/exe	bot.armv7l
File opened for reading	/proc/643/exe	bot.armv7l
File opened for reading	/proc/2/cmdline	bot.armv7l
File opened for reading	/proc/56/comm	bot.armv7l
File opened for reading	/proc/218/cmdline	bot.armv7l
File opened for reading	/proc/36/cmdline	bot.armv7l
File opened for reading	/proc/348/comm	bot.armv7l
File opened for reading	/proc/624/cmdline	bot.armv7l
File opened for reading	/proc/24/cmdline	bot.armv7l
File opened for reading	/proc/29/comm	bot.armv7l
File opened for reading	/proc/36/comm	bot.armv7l
File opened for reading	/proc/45/comm	bot.armv7l
File opened for reading	/proc/728/cmdline	bot.armv7l
File opened for reading	/proc/785/cmdline	bot.armv7l
File opened for reading	/proc/mounts	bot.armv7l
File opened for reading	/proc/728/exe	bot.armv7l
File opened for reading	/proc/19/cmdline	bot.armv7l
File opened for reading	/proc/23/comm	bot.armv7l
File opened for reading	/proc/28/comm	bot.armv7l
File opened for reading	/proc/143/comm	bot.armv7l
File opened for reading	/proc/198/comm	bot.armv7l
File opened for reading	/proc/642/cmdline	bot.armv7l
File opened for reading	/proc/46/cmdline	bot.armv7l
File opened for reading	/proc/381/cmdline	bot.armv7l
File opened for reading	/proc/785/comm	bot.armv7l
File opened for reading	/proc/789/exe	bot.armv7l
File opened for reading	/proc/self/status	bot.armv7l
File opened for reading	/proc/2/comm	bot.armv7l
File opened for reading	/proc/5/cmdline	bot.armv7l
File opened for reading	/proc/8/cmdline	bot.armv7l
File opened for reading	/proc/32/cmdline	bot.armv7l
File opened for reading	/proc/35/comm	bot.armv7l
File opened for reading	/proc/254/comm	bot.armv7l
File opened for reading	/proc/3/cmdline	bot.armv7l

/tmp/bot.armv7l
/tmp/bot.armv7l
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Traces itself
- Creates/modifies Cron job
- Changes its process name
- Reads runtime system information
PID:781

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.lpok

Path /var/.lpok
Size 5B
SHA256 94fb42061c010cff22afdb42298f179884b1b612e0e7e577d37746d93f05af54
MD5 e6088f25c76cceea0f4e85b140022c4b
SHA1 da37407083773b7f4d5d7dfb99dd407968777e7e
SHA512 2e12388fa6f51c34e46f05db31992c6a3c7f7bed6c5e9656dac9d2a5dc91e3729783eda4ca0c8bf221565cb1cf8cd6d8d53be1576d388b549dd9956adcd5f78f
MD5 SHA1 SHA512

Submit Download

Path /var/.x
Size 397KB
SHA256 b09baf2470ed83268357311546aebb1fb0bc64cdc93195c92b95b62019d7778c
MD5 79502edaa99034a93f3d19fd372c6290
SHA1 3dae519d1a359ef5a7af729734706ade146ca971
SHA512 2257ff92ae36c9b205dfa713f9796cd525edce434307c14ba1788f0efa6598e267b9b743bfef011d21942fca33c7edc5cec0c79c6f602504b66007cf9dc900e0
SSDEEP 6144:CGlOHh72NgKIuBN1H47CrqFqIGyUzTpeSqTukRKDjfSHIqX0wqnNDmSv:XlOd4gKXr1YurqBGyUzIFTzRgS90w+v
TLSH
T1C8842B55FC80CA92C5D41B79FB6D434C33171B39D2EEB206CE159B3526EB88B0B7A582
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

root

Path /var/spool/cron/crontabs/root
Size 20B
SHA256 9a263b3ce6ae9ddba05fd95795c6ea63de32a9a59cb57ba8ef2ab49ddd6d6f17
MD5 a3b45018a6abc8ad6f79c25e4bcb290e
SHA1 ad0beb897ded71c3ebd0f6b98c95ea09ddf31503
SHA512 ff3b90d27e80fb36d05abcb304bc498b34f0d94ad06c60df4c04be3a44fe0e45b74ff511b3166022db8daa3c89089483ce0b63a7996d3d2eb61db73f13c16290
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads