Analysis
- max time kernel
150s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
06/04/2026, 22:47
Behavioral task
behavioral1
Sample
arm7.elf
Resource
debian12-armhf-20260127-en
debian-12-armhf
3 signatures
150 seconds
General
- Target arm7.elf
- Size 269KB
- Sample260406-2qlrssdy4q
- SHA256 95c5ef798d621b7276f1dbe0472be6fbcde157ec6f64e9c8a8763fe4c203b145
- MD5 8cf13289e1c4f917bf9e09f33430f6ce
- SHA1 5ab5543101528b10f13b71a58174106542ce7bb4
- SHA512 75e46312c1bc4846aaa2f855efa7eda5286ab2a24ac5822b24b6e0b55152900d120feae3bd5ae957c7380509b8a9b599d3934afaf606c5d1a34d0e32e1953ef3
- SSDEEP 6144:lFDVFEW/3LN6ruLJYgIHDcKksbOqzuv6+tHHWlFn1z42K1F8MX:l/RKAYgiSvn6n0FH
- TLSH T1F64423D8DE83B49DCA1DFB21353F928B71FA191AC618FA18610F10D93AF76F525842C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself init 804 arm7.elf -
description ioc Process File opened for reading /proc/193/status arm7.elf File opened for reading /proc/730/status arm7.elf File opened for reading /proc/874/comm arm7.elf File opened for reading /proc/11/comm arm7.elf File opened for reading /proc/32/status arm7.elf File opened for reading /proc/34/comm arm7.elf File opened for reading /proc/143/status arm7.elf File opened for reading /proc/763/comm arm7.elf File opened for reading /proc/833/cmdline arm7.elf File opened for reading /proc/835/cmdline arm7.elf File opened for reading /proc/837/comm arm7.elf File opened for reading /proc/730/comm arm7.elf File opened for reading /proc/734/status arm7.elf File opened for reading /proc/841/status arm7.elf File opened for reading /proc/842/cmdline arm7.elf File opened for reading /proc/850/status arm7.elf File opened for reading /proc/850/cmdline arm7.elf File opened for reading /proc/872/status arm7.elf File opened for reading /proc/2/status arm7.elf File opened for reading /proc/4/comm arm7.elf File opened for reading /proc/29/status arm7.elf File opened for reading /proc/51/status arm7.elf File opened for reading /proc/200/comm arm7.elf File opened for reading /proc/641/comm arm7.elf File opened for reading /proc/807/status arm7.elf File opened for reading /proc/830/status arm7.elf File opened for reading /proc/831/comm arm7.elf File opened for reading /proc/8/status arm7.elf File opened for reading /proc/45/comm arm7.elf File opened for reading /proc/341/comm arm7.elf File opened for reading /proc/875/comm arm7.elf File opened for reading /proc/14/comm arm7.elf File opened for reading /proc/16/status arm7.elf File opened for reading /proc/838/status arm7.elf File opened for reading /proc/856/comm arm7.elf File opened for reading /proc/838/cmdline arm7.elf File opened for reading /proc/865/comm arm7.elf File opened for reading /proc/23/comm arm7.elf File opened for reading /proc/7/status arm7.elf File opened for reading /proc/812/comm arm7.elf File opened for reading /proc/841/comm arm7.elf File opened for reading /proc/842/status arm7.elf File opened for reading /proc/857/comm arm7.elf File opened for reading /proc/863/cmdline arm7.elf File opened for reading /proc/869/status arm7.elf File opened for reading /proc/18/comm arm7.elf File opened for reading /proc/46/comm arm7.elf File opened for reading /proc/848/cmdline arm7.elf File opened for reading /proc/864/cmdline arm7.elf File opened for reading /proc/876/status arm7.elf File opened for reading /proc/143/comm arm7.elf File opened for reading /proc/801/status arm7.elf File opened for reading /proc/218/status arm7.elf File opened for reading /proc/780/comm arm7.elf File opened for reading /proc/822/status arm7.elf File opened for reading /proc/834/cmdline arm7.elf File opened for reading /proc/840/comm arm7.elf File opened for reading /proc/26/status arm7.elf File opened for reading /proc/33/comm arm7.elf File opened for reading /proc/808/comm arm7.elf File opened for reading /proc/674/comm arm7.elf File opened for reading /proc/763/status arm7.elf File opened for reading /proc/807/comm arm7.elf File opened for reading /proc/829/cmdline arm7.elf