Analysis
- max time kernel
147s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260126-en - resource tags
arch:armhfimage:debian12-armhf-20260126-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
15/04/2026, 04:05
Static task
static1
Behavioral task
behavioral1
Sample
.Sassy.armv7l.elf
Resource
debian12-armhf-20260126-en
debian-12-armhf
4 signatures
150 seconds
General
- Target .Sassy.armv7l.elf
- Size 91KB
- Sample260415-enj4vset6m
- SHA256 5dde3392a1b39edc02f042456957641cec09b5c19ce9eebb50c8f80cf8ba5c07
- MD5 a2e3cf62ae607396cdfdf64a63ea0970
- SHA1 35a8274169a573077bad3f6f5611fbc349e75644
- SHA512 7c2023da16068dbcf214b5405be5ee66d75d7328e3472164f6b75b05e0853fcf2fbee68ca454b2680584b73c85637248e3b71ce74594c387b9b6402bd488331c
- SSDEEP 1536:wqnQEMDz8EdtS/pljv8oWKaFuZMgmMGKPlhKv8ioyXi/9RZRYk6:vMkEvqT78oWKaF8MgmhuyXi/9RjH
- TLSH T16693F649FD416B10E4D635FAFF4F024973934B6CE3FAB201AA245B2523CAA5B0F76416
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 818 .Sassy.armv7l.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/flylegit 818 .Sassy.armv7l.elf -
description ioc Process File opened for reading /proc/4/comm .Sassy.armv7l.elf File opened for reading /proc/13/comm .Sassy.armv7l.elf File opened for reading /proc/30/comm .Sassy.armv7l.elf File opened for reading /proc/32/comm .Sassy.armv7l.elf File opened for reading /proc/35/comm .Sassy.armv7l.elf File opened for reading /proc/51/comm .Sassy.armv7l.elf File opened for reading /proc/193/comm .Sassy.armv7l.elf File opened for reading /proc/312/comm .Sassy.armv7l.elf File opened for reading /proc/8/comm .Sassy.armv7l.elf File opened for reading /proc/733/comm .Sassy.armv7l.elf File opened for reading /proc/218/comm .Sassy.armv7l.elf File opened for reading /proc/25/comm .Sassy.armv7l.elf File opened for reading /proc/20/comm .Sassy.armv7l.elf File opened for reading /proc/21/comm .Sassy.armv7l.elf File opened for reading /proc/22/comm .Sassy.armv7l.elf File opened for reading /proc/641/comm .Sassy.armv7l.elf File opened for reading /proc/642/comm .Sassy.armv7l.elf File opened for reading /proc/673/comm .Sassy.armv7l.elf File opened for reading /proc/9/comm .Sassy.armv7l.elf File opened for reading /proc/12/comm .Sassy.armv7l.elf File opened for reading /proc/338/comm .Sassy.armv7l.elf File opened for reading /proc/341/comm .Sassy.armv7l.elf File opened for reading /proc/806/comm .Sassy.armv7l.elf File opened for reading /proc/812/comm .Sassy.armv7l.elf File opened for reading /proc/7/comm .Sassy.armv7l.elf File opened for reading /proc/18/comm .Sassy.armv7l.elf File opened for reading /proc/788/comm .Sassy.armv7l.elf File opened for reading /proc/314/comm .Sassy.armv7l.elf File opened for reading /proc/3/comm .Sassy.armv7l.elf File opened for reading /proc/15/comm .Sassy.armv7l.elf File opened for reading /proc/45/comm .Sassy.armv7l.elf File opened for reading /proc/206/comm .Sassy.armv7l.elf File opened for reading /proc/772/comm .Sassy.armv7l.elf File opened for reading /proc/2/comm .Sassy.armv7l.elf File opened for reading /proc/14/comm .Sassy.armv7l.elf File opened for reading /proc/142/comm .Sassy.armv7l.elf File opened for reading /proc/317/comm .Sassy.armv7l.elf File opened for reading /proc/670/comm .Sassy.armv7l.elf File opened for reading /proc/810/comm .Sassy.armv7l.elf File opened for reading /proc/816/comm .Sassy.armv7l.elf File opened for reading /proc/11/comm .Sassy.armv7l.elf File opened for reading /proc/17/comm .Sassy.armv7l.elf File opened for reading /proc/42/comm .Sassy.armv7l.elf File opened for reading /proc/46/comm .Sassy.armv7l.elf File opened for reading /proc/316/comm .Sassy.armv7l.elf File opened for reading /proc/803/comm .Sassy.armv7l.elf File opened for reading /proc/5/comm .Sassy.armv7l.elf File opened for reading /proc/23/comm .Sassy.armv7l.elf File opened for reading /proc/56/comm .Sassy.armv7l.elf File opened for reading /proc/24/comm .Sassy.armv7l.elf File opened for reading /proc/1/comm .Sassy.armv7l.elf File opened for reading /proc/33/comm .Sassy.armv7l.elf File opened for reading /proc/36/comm .Sassy.armv7l.elf File opened for reading /proc/781/comm .Sassy.armv7l.elf File opened for reading /proc/814/comm .Sassy.armv7l.elf File opened for reading /proc/31/comm .Sassy.armv7l.elf File opened for reading /proc/356/comm .Sassy.armv7l.elf File opened for reading /proc/6/comm .Sassy.armv7l.elf File opened for reading /proc/16/comm .Sassy.armv7l.elf File opened for reading /proc/27/comm .Sassy.armv7l.elf File opened for reading /proc/332/comm .Sassy.armv7l.elf File opened for reading /proc/26/comm .Sassy.armv7l.elf File opened for reading /proc/29/comm .Sassy.armv7l.elf File opened for reading /proc/34/comm .Sassy.armv7l.elf