Analysis
- max time kernel
149s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
30/10/2026, 22:30
Behavioral task
behavioral1
Sample
armv6l.elf
Resource
debian12-armhf-20260127-en
debian-12-armhf
5 signatures
150 seconds
General
- Target armv6l.elf
- Size 117KB
- Sample261030-2e1ftagy5p
- SHA256 dd8de27e91664669406d97ebf52c5c8d2f7f6356705bd221841b80a6695ce7a6
- MD5 0a7945619836cdf7bbf6caf190e7ccb7
- SHA1 4c1567bb806d6b47613334f9d29892597abdb0fb
- SHA512 fc791cc86b0532791371388297921cf36668b38f11153d8cfb88c9aed59029445b4e6353cb99767c7e46d460aa9107a49a35e77c697104c62874cee0fef01912
- SSDEEP 3072:NwP00m+Urrar8+wG3if7zKeYw1Ljme3WwF:NwPe+U3aDVc7zKu1LjCwF
- TLSH T1C9C31901A9528A53C0C2177ABA9F41593723BB78D3DB3311DA14BFB42F476DF0E2A652
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 786 armv6l.elf - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog armv6l.elf File opened for modification /dev/watchdog armv6l.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself lhoi3goe52pf 786 armv6l.elf -
description ioc Process File opened for reading /proc/2222�3cmdline armv6l.elf File opened for reading /proc/33/stat armv6l.elf File opened for reading /proc/333/stat armv6l.elf File opened for reading /proc/555/stat armv6l.elf File opened for reading /proc/11cmdline armv6l.elf File opened for reading /proc/3333fffffffcmdline armv6l.elf File opened for reading /proc/7777�;cmdline armv6l.elf File opened for reading /proc/8888�;cmdline armv6l.elf File opened for reading /proc/3333�4cmdline armv6l.elf File opened for reading /proc/6666�;cmdline armv6l.elf File opened for reading /proc/7777�;cmdline armv6l.elf File opened for reading /proc/7777�;cmdline armv6l.elf File opened for reading /proc/7777�;cmdline armv6l.elf File opened for reading /proc/1111/stat armv6l.elf File opened for reading /proc/7777�;cmdline armv6l.elf File opened for reading /proc/99ssc/cmdline armv6l.elf File opened for reading /proc/333�/cmdline armv6l.elf File opened for reading /proc/6666J7cmdline armv6l.elf File opened for reading /proc/7777�;cmdline armv6l.elf File opened for reading /proc/7777cmdline armv6l.elf File opened for reading /proc/11/stat armv6l.elf File opened for reading /proc/7777/stat armv6l.elf File opened for reading /proc/7777�;cmdline armv6l.elf File opened for reading /proc/222m�/cmdline armv6l.elf File opened for reading /proc/222v�/cmdline armv6l.elf File opened for reading /proc/7777�;cmdline armv6l.elf File opened for reading /proc/22cmdline armv6l.elf File opened for reading /proc/111e/cmdline armv6l.elf File opened for reading /proc/777k�/cmdline armv6l.elf File opened for reading /proc/3333K5cmdline armv6l.elf File opened for reading /proc/3333�;cmdline armv6l.elf File opened for reading /proc/6666c7cmdline armv6l.elf File opened for reading /proc/7777�;cmdline armv6l.elf File opened for reading /proc/6666[8cmdline armv6l.elf File opened for reading /proc/66cmdline armv6l.elf File opened for reading /proc/77cmdline armv6l.elf File opened for reading /proc/111cu/cmdline armv6l.elf File opened for reading /proc/222cmdline armv6l.elf File opened for reading /proc/33334cmdline armv6l.elf File opened for reading /proc/8888/stat armv6l.elf File opened for reading /proc/33cmdline armv6l.elf File opened for reading /proc/111um/cmdline armv6l.elf File opened for reading /proc/555s�/cmdline armv6l.elf File opened for reading /proc/1111�/cmdline armv6l.elf File opened for reading /proc/1111�1cmdline armv6l.elf File opened for reading /proc/7777�;cmdline armv6l.elf File opened for reading /proc/22/stat armv6l.elf File opened for reading /proc/88/stat armv6l.elf File opened for reading /proc/33335cmdline armv6l.elf File opened for reading /proc/333s�/cmdline armv6l.elf File opened for reading /proc/44cmdline armv6l.elf File opened for reading /proc/111o/cmdline armv6l.elf File opened for reading /proc/222�/cmdline armv6l.elf File opened for reading /proc/55/stat armv6l.elf File opened for reading /proc/111/stat armv6l.elf File opened for reading /proc/222/stat armv6l.elf File opened for reading /proc/333s�/cmdline armv6l.elf File opened for reading /proc/3333m4cmdline armv6l.elf File opened for reading /proc/3333]5cmdline armv6l.elf File opened for reading /proc/7777�;cmdline armv6l.elf File opened for reading /proc/44/stat armv6l.elf File opened for reading /proc/66/stat armv6l.elf File opened for reading /proc/444/stat armv6l.elf File opened for reading /proc/777/stat armv6l.elf - Writes file to shm directory 1 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
description ioc Process File opened for modification /dev/shm/.comm armv6l.elf
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /dev/shm/.comm
- Size 4B
- SHA256 8d7c10fa712cbe4879ad8595846c24e5083da71b23fb5f3e966005bea31fdaf6
- MD5 4d76f847f56a59d0a864183113a0093e
- SHA1 5c40d0d1df5740b6b35aa35b80dd5f3f9b441c49
- SHA512 c22c1a147a218572a1fa8b08677808d30274902b06b41c0adfc0ffcd9eed46cec968d35357a91b8f73a56056f930fef9e9c96c277e43ca459c2485b0c20387cc
- MD5 SHA1 SHA512