d9cf616d3ee2e3876c290d87b32ee7ae84d0bdbaabaad7e2345e85a480e2004e

Analysis

max time kernel
120s
max time network
140s
platform
debian-12_armhf
resource
debian12-armhf-20260126-en
resource tags

arch:armhfimage:debian12-armhf-20260126-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
12/04/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
arm6.elf
Size 229KB
Sample260412-e9m3msdt5j
SHA256 d9cf616d3ee2e3876c290d87b32ee7ae84d0bdbaabaad7e2345e85a480e2004e
MD5 128ae2ceedb20829a6c1ed22b035c8ee
SHA1 3a00edf528c1c482512b69bd1887a7c222e1de36
SHA512 f90b9754a1ca1413a1ab60e39d3221218069d22f4e7eb08835b4a3bb55dfba23c3a656c32effee08770df446aeb313d0cd74488405aeec24b6b924c3d16e2ba7
SSDEEP 6144:XAUxYupsZDff/aj4s7fjOyCShXQuyrnmW2hVDZI0/16O7Nc:XtxuZrf/a57bOyRX2nmW2hVD60/16O7G
TLSH
T119341902A8528A53C5C21B79BB5F46593733AB34D3DB7302DA18AFB42F476DE0E3A511
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm discovery

Malware Config

Signatures

Traces itself 1 IoCs

Traces itself to prevent debugging attempts

pid	Process
787	arm6.elf

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	185.181.61.24

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	arm6.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/bin/bash	787	arm6.elf

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	arm6.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	arm6.elf

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/stat	arm6.elf
File opened for reading	/proc/self/status	arm6.elf
File opened for reading	/proc/sys/kernel/osrelease	arm6.elf

/tmp/arm6.elf
/tmp/arm6.elf
1⤵
- Traces itself
- Enumerates active TCP sockets
- Changes its process name
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
PID:787
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
  2⤵
  PID:798
- /bin/sh
  sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
  2⤵
  PID:800
- - /bin/busybox
    /bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
    3⤵
    PID:802
- /bin/sh
  sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
  2⤵
  PID:804
- - /bin/iptables
    /bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
    3⤵
    PID:807
- /bin/sh
  sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
  2⤵
  PID:808
- - /usr/bin/iptables
    /usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
    3⤵
    PID:809
- /bin/sh
  sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
  2⤵
  PID:810
- - /usr/bin/busybox
    busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
    3⤵
    PID:811

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads