d6c991de2dbfd1c61a7928ac75d31d69e048ee803171efbc7971e9182bf3f7d2

Analysis

max time kernel
148s
max time network
152s
platform
debian-12_armhf
resource
debian12-armhf-20260127-en
resource tags

arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
27/10/2026, 22:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
arm5.elf
Size 369KB
Sample261027-2qlrssgv6y
SHA256 d6c991de2dbfd1c61a7928ac75d31d69e048ee803171efbc7971e9182bf3f7d2
MD5 f47c71cbfc3d1907dea13abe1500dace
SHA1 556711f69c7cb4acaf3db54ec92a6d00c491091e
SHA512 1edcc0fb87cc090581ab6931a51026d221f0d61cf2a3cc430e34f13d0c5d30484ee7bbecb0507f3ebeea13cd786753456505cce4cadd70d4bc366392d46ba392
SSDEEP 6144:o/pafBPUk9HKh23kk+TAAchzeL+wwaxjtT8ca9NO:omRN9HKI1+THm0x53a9NO
TLSH
T18684F988E1F0E7DEE2D4EA75B31D790D3A230736A1D73146A519FE3323E71490AB9921
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	arm5.elf
File opened for modification	/dev/misc/watchdog	arm5.elf

Traces itself 1 IoCs

Traces itself to prevent debugging attempts

pid	Process
809	arm5.elf

Unexpected DNS network traffic destination 10 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	198.51.100.42
Destination IP	192.0.2.201
Destination IP	192.0.2.14
Destination IP	198.51.100.42
Destination IP	203.0.113.77
Destination IP	192.0.2.201
Destination IP	198.51.100.13
Destination IP	203.0.113.77
Destination IP	198.51.100.13
Destination IP	192.0.2.14

Changes its process name 4 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	docker	826	arm5.elf
Changes the process name, possibly in an attempt to hide itself	[jbd2/dm0-8]	826	arm5.elf
Changes the process name, possibly in an attempt to hide itself	nginx	828	arm5.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/u:2]	831	arm5.elf

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	arm5.elf
File opened for reading	/proc/self/status	arm5.elf
File opened for reading	/proc/1/comm	arm5.elf

/tmp/arm5.elf
/tmp/arm5.elf
1⤵
- Modifies Watchdog functionality
- Traces itself
- Changes its process name
- Reads runtime system information
PID:809

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads