Analysis
- max time kernel
149s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20251231-en - resource tags
arch:armhfimage:debian12-armhf-20251231-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
06/01/2026, 05:36
Behavioral task
behavioral1
Sample
main_arm7.elf
Resource
debian12-armhf-20251231-en
4 signatures
150 seconds
General
- Target main_arm7.elf
- Size 177KB
- Sample260106-ga3edswrcw
- SHA256 518014dcfa5c71c360a464743c489a2fcc368ffa9ce73585a0dd4de2a183c225
- MD5 05d5f1ac703f087f5bef2875cde34762
- SHA1 825502f4ac1cdb01924f7ad53d6a3e2dd7173084
- SHA512 f35ef2e18aa09f6b988c6869170e4db18f7f9e6c8365e150e1751fba46dc3c4a1ea409d8eeda34647034d76e26c2c921d2d260e9b907f862beeb172fccce53b4
- SSDEEP 3072:OzeSvtfD84oALv2eEQakGzORuGMzw99L5d38YhTfYo+M/RM+FDhdLn:2eSvJvoA7TEQakGzORuBGL5d38+x+M/z
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 784 main_arm7.elf - Traces itself 2 IoCs
Traces itself to prevent debugging attempts
pid Process 784 main_arm7.elf 785 main_arm7.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 784 main_arm7.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/main_arm7.elf main_arm7.elf