Analysis
- max time kernel
150s - max time network
154s - platform
debian-12_armhf - resource
debian12-armhf-20260126-en - resource tags
- submitted
21/04/2026, 18:29
General
- Target krane_armv6
- Size 6.1MB
- Sample260421-w5eddaew4x
- SHA256 6117f3f72eeacb24536a468c6a6f6d878987dfd88941b9622fc35b25e92581b5
Score
9/10
Malware Config
Signatures
- Contacts a large (133318) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates kernel/hardware configuration 1 TTPs 4 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 6 IoCs
Reads data from /proc virtual filesystem.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes
-
/tmp/krane_armv6/tmp/krane_armv61⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/tmp/krane_armv6/tmp/krane_armv62⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-