Analysis
- max time kernel
149s - max time network
153s - platform
debian-12_armhf - resource
debian12-armhf-20260126-en - resource tags
arch:armhfimage:debian12-armhf-20260126-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
29/04/2026, 13:28
Behavioral task
behavioral1
Sample
bae05a16_arm5.elf
Resource
debian12-armhf-20260126-en
debian-12-armhf
4 signatures
150 seconds
General
- Target bae05a16_arm5.elf
- Size 269KB
- Sample260429-qq2mgagv4k
- SHA256 bfe3c83b6a43db2673b40160a23187331f8c94871245ea80aaee57e0324c400c
- MD5 e92202cc1775341a8110aa1068d1839b
- SHA1 709afe08cdfed39f7082bfdd26886c6fcd27e9c5
- SHA512 03dfa18be273061c4ac7b11c75fa7a53f1ecb789f2796ed428a16d92998e0966a43f8f120a922cb3b9d1c89d731094ea6805c1bd9b610356ec0f1c16150b9009
- SSDEEP 6144:v59j5rPkP+B8Ewz9oY8Tlk3Vjyckw6ybirGoVoXRt03:v5ImBwz+Tu/bpRi3
- TLSH T1F74423680623DBCAD31929E56EFF809C294F77340D582BA085ADD38D07FE039D39E659
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Contacts a large (2194) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself init 785 bae05a16_arm5.elf -
description ioc Process File opened for reading /proc/51/status bae05a16_arm5.elf File opened for reading /proc/620/status bae05a16_arm5.elf File opened for reading /proc/637/status bae05a16_arm5.elf File opened for reading /proc/4/comm bae05a16_arm5.elf File opened for reading /proc/19/status bae05a16_arm5.elf File opened for reading /proc/23/comm bae05a16_arm5.elf File opened for reading /proc/25/comm bae05a16_arm5.elf File opened for reading /proc/28/status bae05a16_arm5.elf File opened for reading /proc/19/comm bae05a16_arm5.elf File opened for reading /proc/667/comm bae05a16_arm5.elf File opened for reading /proc/807/status bae05a16_arm5.elf File opened for reading /proc/13/status bae05a16_arm5.elf File opened for reading /proc/1/status bae05a16_arm5.elf File opened for reading /proc/44/status bae05a16_arm5.elf File opened for reading /proc/44/comm bae05a16_arm5.elf File opened for reading /proc/45/comm bae05a16_arm5.elf File opened for reading /proc/138/status bae05a16_arm5.elf File opened for reading /proc/636/status bae05a16_arm5.elf File opened for reading /proc/817/cmdline bae05a16_arm5.elf File opened for reading /proc/7/status bae05a16_arm5.elf File opened for reading /proc/9/status bae05a16_arm5.elf File opened for reading /proc/189/status bae05a16_arm5.elf File opened for reading /proc/725/status bae05a16_arm5.elf File opened for reading /proc/816/comm bae05a16_arm5.elf File opened for reading /proc/27/status bae05a16_arm5.elf File opened for reading /proc/138/comm bae05a16_arm5.elf File opened for reading /proc/333/status bae05a16_arm5.elf File opened for reading /proc/353/status bae05a16_arm5.elf File opened for reading /proc/357/status bae05a16_arm5.elf File opened for reading /proc/2/status bae05a16_arm5.elf File opened for reading /proc/22/status bae05a16_arm5.elf File opened for reading /proc/24/comm bae05a16_arm5.elf File opened for reading /proc/25/status bae05a16_arm5.elf File opened for reading /proc/32/status bae05a16_arm5.elf File opened for reading /proc/33/comm bae05a16_arm5.elf File opened for reading /proc/374/comm bae05a16_arm5.elf File opened for reading /proc/796/cmdline bae05a16_arm5.elf File opened for reading /proc/36/comm bae05a16_arm5.elf File opened for reading /proc/57/status bae05a16_arm5.elf File opened for reading /proc/780/comm bae05a16_arm5.elf File opened for reading /proc/781/status bae05a16_arm5.elf File opened for reading /proc/802/comm bae05a16_arm5.elf File opened for reading /proc/805/comm bae05a16_arm5.elf File opened for reading /proc/798/status bae05a16_arm5.elf File opened for reading /proc/797/status bae05a16_arm5.elf File opened for reading /proc/73/comm bae05a16_arm5.elf File opened for reading /proc/725/comm bae05a16_arm5.elf File opened for reading /proc/730/status bae05a16_arm5.elf File opened for reading /proc/804/comm bae05a16_arm5.elf File opened for reading /proc/814/comm bae05a16_arm5.elf File opened for reading /proc/36/status bae05a16_arm5.elf File opened for reading /proc/330/status bae05a16_arm5.elf File opened for reading /proc/620/comm bae05a16_arm5.elf File opened for reading /proc/795/status bae05a16_arm5.elf File opened for reading /proc/807/cmdline bae05a16_arm5.elf File opened for reading /proc/798/comm bae05a16_arm5.elf File opened for reading /proc/812/status bae05a16_arm5.elf File opened for reading /proc/811/cmdline bae05a16_arm5.elf File opened for reading /proc/15/comm bae05a16_arm5.elf File opened for reading /proc/23/status bae05a16_arm5.elf File opened for reading /proc/806/comm bae05a16_arm5.elf File opened for reading /proc/810/status bae05a16_arm5.elf File opened for reading /proc/812/comm bae05a16_arm5.elf File opened for reading /proc/814/status bae05a16_arm5.elf