c43af098ea01362628f7b17447e2e040ab74858a5f8fc508acfe50024c5ef6dc

Analysis

max time kernel
9s
max time network
134s
platform
debian-12_armhf
resource
debian12-armhf-20260127-en
resource tags

arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
29/04/2026, 20:30

Target
manji.arm7.elf
Size 110KB
Sample260429-zagf2aby9n
SHA256 c43af098ea01362628f7b17447e2e040ab74858a5f8fc508acfe50024c5ef6dc
MD5 bec53d6301071317dc6641a403b42ee2
SHA1 b8ee6bff7f70edeee144fc9a99d663beb6a8e755
SHA512 8444c50f2b388ee21736c7073e7ec61e3234981d1de498ee6d0b0f60743866dbe3ca0d3c39aa211a8b8881e5ccf147564acf2dd294a3ee6f16f01bfd34f711ef
SSDEEP 3072:hqiKVqVEpOFnYfG/7/0lZYz4BmnlsQatFbR17z9c7YfNpg0w0zeyf:hqiJPdYe/7/0lZYzWylsQatFbR1Vc7Y5
TLSH
T18DB3F946A9429F11D5C631FAFBAF414933136FB8E3FA7111D9206F6023C699B0EB7612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Traces itself 1 IoCs

Traces itself to prevent debugging attempts

pid	Process
815	manji.arm7.elf

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	uhttpd	815	manji.arm7.elf
Changes the process name, possibly in an attempt to hide itself	kswapd	815	manji.arm7.elf

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/mounts	manji.arm7.elf
File opened for reading	/proc/self/status	manji.arm7.elf