Analysis
- max time kernel
149s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
27/10/2026, 13:41
Behavioral task
behavioral1
Sample
parm6.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target parm6.elf
- Size 93KB
- Sample261027-qzcppsdv4z
- SHA256 125abc4ad2e04d8f74d4618599fe41537ac20f59c7f79a70a5f61556c9ff13ed
- MD5 968248dcfc1b48149a5810887e5f6327
- SHA1 2a80ea1246b90c35539da0dba85dba333c4f9529
- SHA512 34b49ccd2ccd10781e27f4bb3b68e6094f27748592ee7a5af6f03d2e8456d0c12ea2e462d292e258de8c2126405c68186c051d4a593e1c806a62a75ffefe482f
- SSDEEP 1536:+ynbKS6RuqjW6l/XInp5QW4iH6Hrof2Pki2YYm/oOcoPFt0OEoOlQQkr1/YeAYI8:mRuc2FaHrW5n8bEDQvr1AeA1StIA
- TLSH T181930A86BC415F26C6D017BAFE2E01CD33131FB8E2EA32169D116F2477DA95A0E7B941
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 784 parm6.elf - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog parm6.elf File opened for modification /dev/misc/watchdog parm6.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself 82vtgajb3g6i265nmh50s534rcu32cnt 784 parm6.elf -
description ioc Process File opened for reading /proc/46cmdline parm6.elf File opened for reading /proc/314cmdline parm6.elf File opened for reading /proc/354cmdline parm6.elf File opened for reading /proc/789cmdline parm6.elf File opened for reading /proc/806cmdline parm6.elf File opened for reading /proc/20cmdline parm6.elf File opened for reading /proc/31cmdline parm6.elf File opened for reading /proc/220cmdline parm6.elf File opened for reading /proc/243cmdline parm6.elf File opened for reading /proc/317cmdline parm6.elf File opened for reading /proc/778cmdline parm6.elf File opened for reading /proc/817cmdline parm6.elf File opened for reading /proc/828cmdline parm6.elf File opened for reading /proc/33cmdline parm6.elf File opened for reading /proc/143cmdline parm6.elf File opened for reading /proc/792cmdline parm6.elf File opened for reading /proc/794cmdline parm6.elf File opened for reading /proc/812cmdline parm6.elf File opened for reading /proc/820cmdline parm6.elf File opened for reading /proc/316cmdline parm6.elf File opened for reading /proc/334cmdline parm6.elf File opened for reading /proc/341cmdline parm6.elf File opened for reading /proc/813cmdline parm6.elf File opened for reading /proc/823cmdline parm6.elf File opened for reading /proc/829cmdline parm6.elf File opened for reading /proc/1cmdline parm6.elf File opened for reading /proc/56cmdline parm6.elf File opened for reading /proc/642cmdline parm6.elf File opened for reading /proc/729cmdline parm6.elf File opened for reading /proc/815cmdline parm6.elf File opened for reading /proc/818cmdline parm6.elf File opened for reading /proc/12cmdline parm6.elf File opened for reading /proc/27cmdline parm6.elf File opened for reading /proc/51cmdline parm6.elf File opened for reading /proc/142cmdline parm6.elf File opened for reading /proc/765cmdline parm6.elf File opened for reading /proc/791cmdline parm6.elf File opened for reading /proc/804cmdline parm6.elf File opened for reading /proc/827cmdline parm6.elf File opened for reading /proc/17cmdline parm6.elf File opened for reading /proc/26cmdline parm6.elf File opened for reading /proc/29cmdline parm6.elf File opened for reading /proc/34cmdline parm6.elf File opened for reading /proc/35cmdline parm6.elf File opened for reading /proc/45cmdline parm6.elf File opened for reading /proc/344cmdline parm6.elf File opened for reading /proc/732cmdline parm6.elf File opened for reading /proc/3cmdline parm6.elf File opened for reading /proc/7cmdline parm6.elf File opened for reading /proc/786cmdline parm6.elf File opened for reading /proc/798cmdline parm6.elf File opened for reading /proc/803cmdline parm6.elf File opened for reading /proc/10cmdline parm6.elf File opened for reading /proc/21cmdline parm6.elf File opened for reading /proc/735cmdline parm6.elf File opened for reading /proc/781cmdline parm6.elf File opened for reading /proc/208cmdline parm6.elf File opened for reading /proc/373cmdline parm6.elf File opened for reading /proc/672cmdline parm6.elf File opened for reading /proc/779cmdline parm6.elf File opened for reading /proc/796cmdline parm6.elf File opened for reading /proc/797cmdline parm6.elf File opened for reading /proc/810cmdline parm6.elf File opened for reading /proc/819cmdline parm6.elf