Analysis
- max time kernel
148s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
16/04/2026, 12:18
Behavioral task
behavioral1
Sample
parm7
Resource
debian12-armhf-20260127-en
3 signatures
150 seconds
General
- Target parm7
- Size 82KB
- Sample260416-pg3mqshw5x
- SHA256 66174ebb8709bdd04d4f4cf0da98d42bccb1f3c14b62e5344d3202e8bf5dfada
- MD5 8588027ebbff10efbdab505133d7f204
- SHA1 5bdd912af9bb16771b319bdb6e0b35cd34e7ee8b
- SHA512 74e8b675d94ece7f68d42b796ea0178651861139714009cdfd7cc96f9c528c8f67340744df4b80907910e6616e8959fe141f3cb981e86e930efbaa5e2e106bcb
- SSDEEP 1536:NtnpR3IuWSHhUGba557wNjxDlFNNWirZYs92wQG8mr2llyUeJizYdQwbZnjud:r3IBuUGevwBLsirZYs92wQEb8YdQwbZK
- TLSH T112830845BD829E01C4DA23BAFA6E008D33537BA9D3FE7112CD116F5073CA99B0EB6552
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 787 parm7 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /var/Sofia 787 parm7 - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/parm7 parm7