Analysis
- max time kernel
144s - max time network
147s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
27/10/2026, 12:09
Behavioral task
behavioral1
Sample
fuck
Resource
debian12-armhf-20260513-en
3 signatures
150 seconds
General
- Target fuck
- Size 118KB
- Sample261027-pbnlmade44
- SHA256 8e4400da4b0ad5f45f8fe122cffc3ca0b26bfbca4657bb0883c0740ab3d1af11
- MD5 04ac6aa651fb1b5d30b06e03ac5e0728
- SHA1 51569742067f8cfe7e225c1d42211fa55858ed69
- SHA512 ae32d5c1486997b6fb6c515e2141de733067bec23ba2eb1e309e7f2a1c81724bdb587fa1c4adc677dbc0405ba9817941b17f110d17c471d29a65a43eeeebb24c
- SSDEEP 3072:r7pn7kxuxlD4QYLsRo2nSs7e+4x+Aa6vRkQoB:X5kxqGD4TSqDAakzY
- TLSH T10BC312F0DDA8EAC780615627EAE5C81324C48FF0E3FE712427286CE5A06F4157B53B96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog fuck File opened for modification /dev/misc/watchdog fuck - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself bkg8bc0wr 791 fuck -
description ioc Process File opened for reading /proc/self/exe fuck File opened for reading /proc/self/fd fuck