Analysis
- max time kernel
1s - max time network
5s - platform
debian-9_armhf - resource
debian9-armhf-20240611-en - resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
12/03/2025, 09:23
Behavioral task
behavioral1
Sample
a51ac88920838035e758b9c20912867c51f78e76bc27fb6bf57128eb7ada54f8.vir
Resource
debian9-armhf-20240611-en
2 signatures
150 seconds
General
- Target a51ac88920838035e758b9c20912867c51f78e76bc27fb6bf57128eb7ada54f8.vir
- Size 4.6MB
- Sample250312-lcvvjsvly6
- SHA256 a51ac88920838035e758b9c20912867c51f78e76bc27fb6bf57128eb7ada54f8
- MD5 54019336e6fbb7b9e621821f9b9f0a5c
- SHA1 bd4a00b9194db65d78053ede828ec3107ba982cd
- SHA512 08e1dd28765b65033637c97afc2d517f8179ac800b67b4897c97a8af86186f24a43cc11b028b202a3cb46389ad51c4779b5d722e63e27b124bf53dd37d30f361
- SSDEEP 49152:Gj9jMidSyBRoVTc8jLq3eKDrg/czUJlCCLrR1KuAb7/C:MjFdSERWTc8q3eR6/C
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size a51ac88920838035e758b9c20912867c51f78e76bc27fb6bf57128eb7ada54f8.vir - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/a51ac88920838035e758b9c20912867c51f78e76bc27fb6bf57128eb7ada54f8.vir.pid a51ac88920838035e758b9c20912867c51f78e76bc27fb6bf57128eb7ada54f8.vir