Analysis
- max time kernel
141s - max time network
149s - platform
debian-12_armhf - resource
debian12-armhf-20250619-en - resource tags
arch:armhfimage:debian12-armhf-20250619-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
23/10/2025, 00:08
Behavioral task
behavioral1
Sample
arm7.elf
Resource
debian12-armhf-20250619-en
debian-12-armhf
5 signatures
150 seconds
General
- Target arm7.elf
- Size 176KB
- Sample251023-aev3jsdr7v
- SHA256 09f984f4807b66e9f54d5678a8bc751f0b1fa810320f2dd0a9e9a022fbf35abf
- MD5 96bac5b36e1d06aae1a1898c939d2a5d
- SHA1 2e3102132419e4dda6ca884281625df3d633ce66
- SHA512 852310ae32414af0e0b7c287422b6d11cde2b3f9ba9bc7725fa0d480515a37d4c97de56efa1f96ff05d23844eb247ebe8a7f10f1d603903f2b4a09b6af6e2a99
- SSDEEP 3072:GxktOitbO+AAagk4B/YnGswmhsIXakst1+XUnPM/9CY3tZ:sksitalAagk4B/YGsvsAaRtUXUPM/9C8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 782 arm7.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/726/mem arm7.elf File opened for reading /proc/793/maps arm7.elf File opened for reading /proc/25/maps arm7.elf File opened for reading /proc/25/mem arm7.elf File opened for reading /proc/46/maps arm7.elf File opened for reading /proc/190/maps arm7.elf File opened for reading /proc/194/maps arm7.elf File opened for reading /proc/26/maps arm7.elf File opened for reading /proc/26/mem arm7.elf File opened for reading /proc/73/mem arm7.elf File opened for reading /proc/199/maps arm7.elf File opened for reading /proc/337/mem arm7.elf File opened for reading /proc/229/mem arm7.elf File opened for reading /proc/240/maps arm7.elf File opened for reading /proc/640/mem arm7.elf File opened for reading /proc/5/mem arm7.elf File opened for reading /proc/33/maps arm7.elf File opened for reading /proc/621/maps arm7.elf File opened for reading /proc/32/mem arm7.elf File opened for reading /proc/140/mem arm7.elf File opened for reading /proc/340/mem arm7.elf File opened for reading /proc/354/mem arm7.elf File opened for reading /proc/22/mem arm7.elf File opened for reading /proc/29/mem arm7.elf File opened for reading /proc/30/mem arm7.elf File opened for reading /proc/31/maps arm7.elf File opened for reading /proc/350/maps arm7.elf File opened for reading /proc/13/maps arm7.elf File opened for reading /proc/42/mem arm7.elf File opened for reading /proc/56/mem arm7.elf File opened for reading /proc/73/maps arm7.elf File opened for reading /proc/199/mem arm7.elf File opened for reading /proc/11/maps arm7.elf File opened for reading /proc/21/maps arm7.elf File opened for reading /proc/34/mem arm7.elf File opened for reading /proc/46/mem arm7.elf File opened for reading /proc/57/maps arm7.elf File opened for reading /proc/640/maps arm7.elf File opened for reading /proc/672/maps arm7.elf File opened for reading /proc/190/mem arm7.elf File opened for reading /proc/8/mem arm7.elf File opened for reading /proc/12/mem arm7.elf File opened for reading /proc/18/mem arm7.elf File opened for reading /proc/372/mem arm7.elf File opened for reading /proc/672/mem arm7.elf File opened for reading /proc/3/maps arm7.elf File opened for reading /proc/4/mem arm7.elf File opened for reading /proc/6/maps arm7.elf File opened for reading /proc/14/maps arm7.elf File opened for reading /proc/20/mem arm7.elf File opened for reading /proc/23/mem arm7.elf File opened for reading /proc/56/maps arm7.elf File opened for reading /proc/315/maps arm7.elf File opened for reading /proc/19/maps arm7.elf File opened for reading /proc/34/maps arm7.elf File opened for reading /proc/44/mem arm7.elf File opened for reading /proc/139/mem arm7.elf File opened for reading /proc/372/maps arm7.elf File opened for reading /proc/679/maps arm7.elf File opened for reading /proc/781/mem arm7.elf File opened for reading /proc/28/maps arm7.elf File opened for reading /proc/639/maps arm7.elf File opened for reading /proc/28/mem arm7.elf File opened for reading /proc/30/maps arm7.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself gpioc_daemon 782 arm7.elf -
description ioc Process File opened for reading /proc/45/comm arm7.elf File opened for reading /proc/240/comm arm7.elf File opened for reading /proc/672/comm arm7.elf File opened for reading /proc/18/comm arm7.elf File opened for reading /proc/780/comm arm7.elf File opened for reading /proc/217/comm arm7.elf File opened for reading /proc/337/comm arm7.elf File opened for reading /proc/8/comm arm7.elf File opened for reading /proc/12/comm arm7.elf File opened for reading /proc/73/comm arm7.elf File opened for reading /proc/27/comm arm7.elf File opened for reading /proc/26/comm arm7.elf File opened for reading /proc/4/comm arm7.elf File opened for reading /proc/5/comm arm7.elf File opened for reading /proc/10/comm arm7.elf File opened for reading /proc/13/comm arm7.elf File opened for reading /proc/340/comm arm7.elf File opened for reading /proc/7/comm arm7.elf File opened for reading /proc/16/comm arm7.elf File opened for reading /proc/19/comm arm7.elf File opened for reading /proc/29/comm arm7.elf File opened for reading /proc/57/comm arm7.elf File opened for reading /proc/354/comm arm7.elf File opened for reading /proc/765/comm arm7.elf File opened for reading /proc/139/comm arm7.elf File opened for reading /proc/194/comm arm7.elf File opened for reading /proc/15/comm arm7.elf File opened for reading /proc/22/comm arm7.elf File opened for reading /proc/30/comm arm7.elf File opened for reading /proc/31/comm arm7.elf File opened for reading /proc/36/comm arm7.elf File opened for reading /proc/44/comm arm7.elf File opened for reading /proc/310/comm arm7.elf File opened for reading /proc/729/comm arm7.elf File opened for reading /proc/28/comm arm7.elf File opened for reading /proc/350/comm arm7.elf File opened for reading /proc/726/comm arm7.elf File opened for reading /proc/9/comm arm7.elf File opened for reading /proc/14/comm arm7.elf File opened for reading /proc/25/comm arm7.elf File opened for reading /proc/33/comm arm7.elf File opened for reading /proc/372/comm arm7.elf File opened for reading /proc/24/comm arm7.elf File opened for reading /proc/56/comm arm7.elf File opened for reading /proc/6/comm arm7.elf File opened for reading /proc/20/comm arm7.elf File opened for reading /proc/51/comm arm7.elf File opened for reading /proc/199/comm arm7.elf File opened for reading /proc/314/comm arm7.elf File opened for reading /proc/35/comm arm7.elf File opened for reading /proc/329/comm arm7.elf File opened for reading /proc/11/comm arm7.elf File opened for reading /proc/17/comm arm7.elf File opened for reading /proc/640/comm arm7.elf File opened for reading /proc/190/comm arm7.elf File opened for reading /proc/315/comm arm7.elf File opened for reading /proc/621/comm arm7.elf File opened for reading /proc/781/comm arm7.elf File opened for reading /proc/783/comm arm7.elf File opened for reading /proc/42/comm arm7.elf File opened for reading /proc/140/comm arm7.elf File opened for reading /proc/229/comm arm7.elf File opened for reading /proc/312/comm arm7.elf File opened for reading /proc/639/comm arm7.elf