Analysis
- max time kernel
144s - max time network
143s - platform
debian-12_armhf - resource
debian12-armhf-20260126-en - resource tags
- submitted
02/05/2026, 00:18
General
- Target ARMV6L
- Size 94KB
- Sample260502-allgpafs8v
- SHA256 cdf7e0346ea4f27dc3aa07e98ef4d1d87fe269bcf45022999931f84ddb0c0ece
Score
7/10
Malware Config
Signatures
- Traces itself 18 IoCs
Traces itself to prevent debugging attempts
- Changes its process name 2 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/ARMV6L/tmp/ARMV6L1⤵
- Traces itself
- Changes its process name
- Checks CPU configuration
- Reads runtime system information