adb81bbaeed04a9b0026d6521d6639452a83af1b0286ea129da7f5edae1dcb99

Analysis

max time kernel
9s
max time network
140s
platform
debian-12_armhf
resource
debian12-armhf-20260126-en
resource tags

arch:armhfimage:debian12-armhf-20260126-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
03/05/2026, 12:16

Target
manji.arm6
Size 94KB
Sample260503-pfx1vsg151
SHA256 adb81bbaeed04a9b0026d6521d6639452a83af1b0286ea129da7f5edae1dcb99
MD5 366e88983fdc3a2fc2624afad8ad6c40
SHA1 abdb0a26bf53872dedc87159040ca5136d11d520
SHA512 11a30b1846a8b6855264e51c59b9d68490682590a9b1d8f09479763309911defc4d9685de40dbf00c9685e81beb975d0c0004969ab76ded7eac26fc3a656dbc5
SSDEEP 1536:870nOhjxCMMJEl3EVupOFnjRfGqtCMPc5pyHtLoY08ivJa2RPk0aDQOiFYgNf65J:mtCxEqVupOFntfGqtCl5gHZo6ivJa26P
TLSH
T196930C46A9528E12C5C212BEFAAF415D33136F7CD3EE7212DD20AFA063865DB0D77612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Traces itself 1 IoCs

Traces itself to prevent debugging attempts

pid	Process
793	manji.arm6

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	uhttpd	793	manji.arm6
Changes the process name, possibly in an attempt to hide itself	telnetd	793	manji.arm6

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/mounts	manji.arm6
File opened for reading	/proc/self/status	manji.arm6