Analysis
- max time kernel
150s - max time network
150s - platform
debian-9_armhf - resource
debian9-armhf-20250619-en - resource tags
arch:armhfimage:debian9-armhf-20250619-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
09/08/2025, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
armv5l.elf
Resource
debian9-armhf-20250619-en
debian-9-armhf
5 signatures
150 seconds
General
- Target armv5l.elf
- Size 156KB
- Sample250809-wfyeysvmx2
- SHA256 286cabdc872dda01bebbb55ef041fa75e2bd66339de286e8a133ad5852d8d3c1
- MD5 f0443c1d31c2a310ba5e162803e03fb4
- SHA1 4b631ca68ab9a2c5b08bca498cac1aef7ccaa7c9
- SHA512 346d95687fef92647b1e01c9e2d744122d69ced5f27f1ee37180e5132bbb138f51e2dc7e25b5d533a1f7ea46189359f64e1b25e04f09606a5f6fb41959ff10bc
- SSDEEP 3072:eGybtWT7nKfUL4Vg8+lRSRno9pQhFwvFIOFhLiejwtSml/H:e1btWT7nKfUL46lioXQhFwtIOFhOesSC
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 645 armv5l.elf - Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/xs.main armv5l.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself -sh 645 armv5l.elf -
description ioc Process File opened for reading /proc/705/status armv5l.elf File opened for reading /proc/775/status armv5l.elf File opened for reading /proc/298/cmdline armv5l.elf File opened for reading /proc/578/comm armv5l.elf File opened for reading /proc/8/status armv5l.elf File opened for reading /proc/635/status armv5l.elf File opened for reading /proc/737/status armv5l.elf File opened for reading /proc/761/comm armv5l.elf File opened for reading /proc/324/comm armv5l.elf File opened for reading /proc/659/status armv5l.elf File opened for reading /proc/651/cmdline armv5l.elf File opened for reading /proc/720/status armv5l.elf File opened for reading /proc/41/comm armv5l.elf File opened for reading /proc/42/comm armv5l.elf File opened for reading /proc/651/status armv5l.elf File opened for reading /proc/295/cmdline armv5l.elf File opened for reading /proc/634/cmdline armv5l.elf File opened for reading /proc/768/status armv5l.elf File opened for reading /proc/26/status armv5l.elf File opened for reading /proc/8/comm armv5l.elf File opened for reading /proc/10/comm armv5l.elf File opened for reading /proc/17/status armv5l.elf File opened for reading /proc/649/status armv5l.elf File opened for reading /proc/109/cmdline armv5l.elf File opened for reading /proc/711/comm armv5l.elf File opened for reading /proc/21/comm armv5l.elf File opened for reading /proc/23/comm armv5l.elf File opened for reading /proc/135/comm armv5l.elf File opened for reading /proc/147/comm armv5l.elf File opened for reading /proc/298/status armv5l.elf File opened for reading /proc/135/cmdline armv5l.elf File opened for reading /proc/666/cmdline armv5l.elf File opened for reading /proc/635/cmdline armv5l.elf File opened for reading /proc/716/status armv5l.elf File opened for reading /proc/7/comm armv5l.elf File opened for reading /proc/28/comm armv5l.elf File opened for reading /proc/576/status armv5l.elf File opened for reading /proc/666/status armv5l.elf File opened for reading /proc/294/cmdline armv5l.elf File opened for reading /proc/684/status armv5l.elf File opened for reading /proc/42/status armv5l.elf File opened for reading /proc/41/status armv5l.elf File opened for reading /proc/578/cmdline armv5l.elf File opened for reading /proc/650/comm armv5l.elf File opened for reading /proc/683/status armv5l.elf File opened for reading /proc/23/status armv5l.elf File opened for reading /proc/715/status armv5l.elf File opened for reading /proc/11/status armv5l.elf File opened for reading /proc/135/status armv5l.elf File opened for reading /proc/775/cmdline armv5l.elf File opened for reading /proc/777/comm armv5l.elf File opened for reading /proc/4/comm armv5l.elf File opened for reading /proc/13/comm armv5l.elf File opened for reading /proc/574/status armv5l.elf File opened for reading /proc/738/cmdline armv5l.elf File opened for reading /proc/774/status armv5l.elf File opened for reading /proc/154/comm armv5l.elf File opened for reading /proc/637/comm armv5l.elf File opened for reading /proc/576/cmdline armv5l.elf File opened for reading /proc/760/comm armv5l.elf File opened for reading /proc/168/status armv5l.elf File opened for reading /proc/14/comm armv5l.elf File opened for reading /proc/147/status armv5l.elf File opened for reading /proc/759/status armv5l.elf
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/init.d/xs.main
- Size 22B
- SHA256 e7678c30c8b78d38c928b586c946dc61e0858b7ce6c48ec6eefdaea79c9be996
- MD5 034fb1d5ede97735588b7b51cc567509
- SHA1 e18e2f383d7b378278ced67d8ae17b023a65ecb7
- SHA512 4e378c74cc212feb02d3b32a4bfff3dd6707e8e1d608370eeaa7f725123a42e5baee218d1836af982caaca8a053dc5c781c758941a6fe699935d8238b1ff46be
- MD5 SHA1 SHA512
- Path /var/main
- Size 156KB
- SHA256 286cabdc872dda01bebbb55ef041fa75e2bd66339de286e8a133ad5852d8d3c1
- MD5 f0443c1d31c2a310ba5e162803e03fb4
- SHA1 4b631ca68ab9a2c5b08bca498cac1aef7ccaa7c9
- SHA512 346d95687fef92647b1e01c9e2d744122d69ced5f27f1ee37180e5132bbb138f51e2dc7e25b5d533a1f7ea46189359f64e1b25e04f09606a5f6fb41959ff10bc
- SSDEEP 3072:eGybtWT7nKfUL4Vg8+lRSRno9pQhFwvFIOFhLiejwtSml/H:e1btWT7nKfUL46lioXQhFwtIOFhOesSC
- MD5 SHA1 SHA512 SSDEEP