Analysis
- max time kernel
150s - max time network
150s - platform
debian-12_armhf - resource
debian12-armhf-20250619-en - resource tags
arch:armhfimage:debian12-armhf-20250619-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
10/11/2025, 13:21
Behavioral task
behavioral1
Sample
arm7.uhavenobotsxd.elf
Resource
debian12-armhf-20250619-en
2 signatures
150 seconds
General
- Target arm7.uhavenobotsxd.elf
- Size 162KB
- Sample251110-qlstrsgn5x
- SHA256 7824ecf222bcfd3f51efa8f1b69b4fb95df0a2390a2d19c2ed963da34e612c7a
- MD5 534cd93d1ecdd3dbe31e854640eb80ea
- SHA1 65ee04cf2fc9027267c01993852c5fddfa056b30
- SHA512 76b2a8730aaf9c3cacd8fdd3a9cf643ba7b0046186301b43909f5167298bf7d00434dc8d7316937cc83d85a6d5d0fec271796c61f7c1e4674d425e49cbc39774
- SSDEEP 3072:80zC6nXLaA7+ou37wMQnhEzACDSm1ya3LnZM/9Kk6fJFh:VtbaA7+ou3pQuzlDS8ya3LZM/9KRJL
- MD5 SHA1 SHA512 SSDEEP
Score
4/10
Malware Config
Signatures
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a 781 arm7.uhavenobotsxd.elf -
description ioc Process File opened for reading /proc/mounts arm7.uhavenobotsxd.elf File opened for reading /proc/801/stat arm7.uhavenobotsxd.elf File opened for reading /proc/802/stat arm7.uhavenobotsxd.elf File opened for reading /proc/802/cmdline arm7.uhavenobotsxd.elf File opened for reading /proc/803/stat arm7.uhavenobotsxd.elf File opened for reading /proc/805/stat arm7.uhavenobotsxd.elf File opened for reading /proc/805/cmdline arm7.uhavenobotsxd.elf