Analysis
- max time kernel
150s - max time network
147s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
02/11/2026, 12:20
Static task
static1
Behavioral task
behavioral1
Sample
arm7
Resource
debian12-armhf-20260127-en
debian-12-armhf
6 signatures
150 seconds
General
- Target arm7
- Size 196KB
- Sample261102-ph62jsbz4j
- SHA256 8bd2ba21d2cc13916e0d15ac0d0208795926e45ff0977e7bb11553e117014119
- MD5 a9ae61e02602408c4e764dff7f2f295e
- SHA1 25b4c425e5e8e68900651ce07939c46e63920bb7
- SHA512 9dfb9cfeeaeb93b8b40cd0e85745b6299314fb9fd9d9a01b67f4dc20a565f0fef2b56b99c0aa6dd6a7aab4c390fd91011f86f9fe4807a4821f97a957f9eed50c
- SSDEEP 6144:szBEpbm3+UNYPXQ2IXWgWUq6UaqZJxxhShaEMXrjd+rS:9Vm3+kCQ2IxJUaqfhShaE2rjd
- TLSH T171141B46BDC19F02C5D226BAFABEC18933136FB8D3FB71128D215F6023865974E76A11
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog arm7 File opened for modification /dev/misc/watchdog arm7 - Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/root arm7 - Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/procmon arm7 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself telnetd 783 arm7 -
description ioc Process File opened for reading /proc/46/exe arm7 File opened for reading /proc/1/cmdline arm7 File opened for reading /proc/12/cmdline arm7 File opened for reading /proc/27/cmdline arm7 File opened for reading /proc/33/cmdline arm7 File opened for reading /proc/42/cmdline arm7 File opened for reading /proc/17/exe arm7 File opened for reading /proc/self/status arm7 File opened for reading /proc/142/cmdline arm7 File opened for reading /proc/798/cmdline arm7 File opened for reading /proc/20/exe arm7 File opened for reading /proc/345/exe arm7 File opened for reading /proc/681/exe arm7 File opened for reading /proc/780/exe arm7 File opened for reading /proc/24/cmdline arm7 File opened for reading /proc/31/cmdline arm7 File opened for reading /proc/730/cmdline arm7 File opened for reading /proc/21/exe arm7 File opened for reading /proc/57/exe arm7 File opened for reading /proc/193/cmdline arm7 File opened for reading /proc/20/cmdline arm7 File opened for reading /proc/24/exe arm7 File opened for reading /proc/28/exe arm7 File opened for reading /proc/193/exe arm7 File opened for reading /proc/361/exe arm7 File opened for reading /proc/10/cmdline arm7 File opened for reading /proc/375/cmdline arm7 File opened for reading /proc/681/cmdline arm7 File opened for reading /proc/4/exe arm7 File opened for reading /proc/18/exe arm7 File opened for reading /proc/34/exe arm7 File opened for reading /proc/334/exe arm7 File opened for reading /proc/198/cmdline arm7 File opened for reading /proc/221/cmdline arm7 File opened for reading /proc/318/cmdline arm7 File opened for reading /proc/788/cmdline arm7 File opened for reading /proc/14/cmdline arm7 File opened for reading /proc/56/cmdline arm7 File opened for reading /proc/73/cmdline arm7 File opened for reading /proc/793/cmdline arm7 File opened for reading /proc/5/cmdline arm7 File opened for reading /proc/7/cmdline arm7 File opened for reading /proc/10/exe arm7 File opened for reading /proc/14/exe arm7 File opened for reading /proc/221/exe arm7 File opened for reading /proc/644/exe arm7 File opened for reading /proc/787/exe arm7 File opened for reading /proc/36/cmdline arm7 File opened for reading /proc/21/cmdline arm7 File opened for reading /proc/2/exe arm7 File opened for reading /proc/316/exe arm7 File opened for reading /proc/334/cmdline arm7 File opened for reading /proc/780/cmdline arm7 File opened for reading /proc/786/cmdline arm7 File opened for reading /proc/792/cmdline arm7 File opened for reading /proc/stat arm7 File opened for reading /proc/7/exe arm7 File opened for reading /proc/4/cmdline arm7 File opened for reading /proc/9/cmdline arm7 File opened for reading /proc/30/cmdline arm7 File opened for reading /proc/219/cmdline arm7 File opened for reading /proc/19/exe arm7 File opened for reading /proc/35/exe arm7 File opened for reading /proc/257/exe arm7
Processes
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/init.d/procmon
- Size 35B
- SHA256 08b40a23d18baebad00e2e329097c86e417ad0e12371c4d6586b1110a86fb480
- MD5 b08865c9536c7df3f11c32df8285d9bf
- SHA1 9a3b0bc2dbe5e70cbea0ae8ce15278b0384f33c1
- SHA512 4c40579114705921cbb4c20e598cf5fcb1b74eb5a0ee49d7da54555218082f926c54bf1c613d145d7b228308732ab72f23d31f4232f8ab1d1fcc422619f126ea
- MD5 SHA1 SHA512
- Path /var/spool/cron/crontabs/root
- Size 18B
- SHA256 51b0336240688b1ab1d0ff432cb1c4ed4ece34c4a59f9b9f817696a13e00195d
- MD5 e294efece43ed4594574a1b33e9288a8
- SHA1 5f051ab31c1d387871b19110c177cb27c1b16021
- SHA512 865882a288ac025dc6895cf42a0da7e25eef1aab327133e686e5ccdeddefd0fb62b764c5d8c545c51bc0d05298c8bec14682def7184f269f9b2176aa2b39bfe4
- MD5 SHA1 SHA512