Analysis
- max time kernel
149s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260126-en - resource tags
arch:armhfimage:debian12-armhf-20260126-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
05/05/2026, 17:28
Static task
static1
Behavioral task
behavioral1
Sample
iran.armv7l
Resource
debian12-armhf-20260126-en
debian-12-armhf
4 signatures
150 seconds
General
- Target iran.armv7l
- Size 91KB
- Sample260505-v2fllact9s
- SHA256 a1702eece472a35c441a5662f1aa4310e6d276256e8688a278ff6b20276e96f8
- MD5 06322446af8826c688081bcaaf746836
- SHA1 32f9e14430f1f452033c651a8bdffe3b8a8636d5
- SHA512 dde9d0eff990e83343907fa169bf934fb59524d22f2484c7bd72a0187fa1188acc238ad5ad40275518b788e1bbb3aceca4a04f6bf4dbc35b81b5d8a7f7ae17bb
- SSDEEP 1536:4AnDhz4jhPNtCEZwGvgZsgpaLtgwehuXtKlsRcPit5YgTCBZlYeO:xMP/ZW0QsgpaLtgweOI65YgTCBHV
- TLSH T1E9930749FD416B10E8D635FAFB4F024973934B6CE3FE7201AA245B2123CAA5B0F76506
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 793 iran.armv7l - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/flylegit 793 iran.armv7l -
description ioc Process File opened for reading /proc/9/comm iran.armv7l File opened for reading /proc/10/comm iran.armv7l File opened for reading /proc/16/comm iran.armv7l File opened for reading /proc/36/comm iran.armv7l File opened for reading /proc/402/comm iran.armv7l File opened for reading /proc/14/comm iran.armv7l File opened for reading /proc/15/comm iran.armv7l File opened for reading /proc/26/comm iran.armv7l File opened for reading /proc/316/comm iran.armv7l File opened for reading /proc/781/comm iran.armv7l File opened for reading /proc/7/comm iran.armv7l File opened for reading /proc/30/comm iran.armv7l File opened for reading /proc/319/comm iran.armv7l File opened for reading /proc/322/comm iran.armv7l File opened for reading /proc/621/comm iran.armv7l File opened for reading /proc/2/comm iran.armv7l File opened for reading /proc/142/comm iran.armv7l File opened for reading /proc/208/comm iran.armv7l File opened for reading /proc/728/comm iran.armv7l File opened for reading /proc/12/comm iran.armv7l File opened for reading /proc/20/comm iran.armv7l File opened for reading /proc/34/comm iran.armv7l File opened for reading /proc/330/comm iran.armv7l File opened for reading /proc/782/comm iran.armv7l File opened for reading /proc/3/comm iran.armv7l File opened for reading /proc/4/comm iran.armv7l File opened for reading /proc/8/comm iran.armv7l File opened for reading /proc/13/comm iran.armv7l File opened for reading /proc/27/comm iran.armv7l File opened for reading /proc/366/comm iran.armv7l File opened for reading /proc/785/comm iran.armv7l File opened for reading /proc/788/comm iran.armv7l File opened for reading /proc/25/comm iran.armv7l File opened for reading /proc/42/comm iran.armv7l File opened for reading /proc/257/comm iran.armv7l File opened for reading /proc/309/comm iran.armv7l File opened for reading /proc/22/comm iran.armv7l File opened for reading /proc/35/comm iran.armv7l File opened for reading /proc/44/comm iran.armv7l File opened for reading /proc/46/comm iran.armv7l File opened for reading /proc/334/comm iran.armv7l File opened for reading /proc/681/comm iran.armv7l File opened for reading /proc/5/comm iran.armv7l File opened for reading /proc/17/comm iran.armv7l File opened for reading /proc/31/comm iran.armv7l File opened for reading /proc/51/comm iran.armv7l File opened for reading /proc/56/comm iran.armv7l File opened for reading /proc/356/comm iran.armv7l File opened for reading /proc/639/comm iran.armv7l File opened for reading /proc/727/comm iran.armv7l File opened for reading /proc/18/comm iran.armv7l File opened for reading /proc/45/comm iran.armv7l File opened for reading /proc/783/comm iran.armv7l File opened for reading /proc/784/comm iran.armv7l File opened for reading /proc/6/comm iran.armv7l File opened for reading /proc/19/comm iran.armv7l File opened for reading /proc/24/comm iran.armv7l File opened for reading /proc/29/comm iran.armv7l File opened for reading /proc/198/comm iran.armv7l File opened for reading /proc/786/comm iran.armv7l File opened for reading /proc/11/comm iran.armv7l File opened for reading /proc/32/comm iran.armv7l File opened for reading /proc/73/comm iran.armv7l File opened for reading /proc/362/comm iran.armv7l