Analysis
- max time kernel
135s - max time network
147s - platform
debian-12_armhf - resource
debian12-armhf-20250619-en - resource tags
arch:armhfimage:debian12-armhf-20250619-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
22/06/2025, 11:27
Behavioral task
behavioral1
Sample
cutearm7.elf
Resource
debian12-armhf-20250619-en
4 signatures
150 seconds
General
- Target cutearm7.elf
- Size 99KB
- Sample250622-nkhlaszky2
- SHA256 5cdfd9ba515451ef7fb64560d450fef436addebc4e078e4ed0d8210f2dee448d
- MD5 1c83c481329beac94e3bbd537acc0e28
- SHA1 29a8ce3c66a8b5d44bf6dd891d656c0fe34ca9d9
- SHA512 f94b790e6750fb6d48b213ff72b28a3f7cf9935eda9e4a0f05a3e75d40ee1beb8e78668cd75ad1e88447e4b708c6b8a015bf357061e10a55524306a5ded3c4af
- SSDEEP 3072:sCgl+9ADXCegj+rCzAGYK2UiM/9vTBdiF:sCgUwXCegj+UA7K2zM/97WF
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 778 cutearm7.elf - Traces itself 2 IoCs
Traces itself to prevent debugging attempts
pid Process 778 cutearm7.elf 782 cutearm7.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 778 cutearm7.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/cutearm7.elf cutearm7.elf