Analysis
- max time kernel
149s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260126-en - resource tags
arch:armhfimage:debian12-armhf-20260126-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
07/05/2026, 00:19
Behavioral task
behavioral1
Sample
bin.armv7l
Resource
debian12-armhf-20260126-en
debian-12-armhf
5 signatures
150 seconds
General
- Target bin.armv7l
- Size 166KB
- Sample260507-amcaeact5t
- SHA256 560a3e1264aa447a680ac2deb7b8e71e2ec8c45a1e710e4ad3838396d82942a5
- MD5 884166bfa66069650d569a878f1f3047
- SHA1 6d550227d6463cad3d3936fd280e84d784841d29
- SHA512 af11cdcfabf113d327e71bd040ffe4c5eb2cf682cac4ff97df20fb1ec4c7e8911f7c1459282fb6bd48eaef700b1d43602ea101e046245cb366f0fecbb7718c98
- SSDEEP 3072:qLWyCGIfja9T0hXqEJBEKDqpXrNP32MiL/KEYRz:q/Ofja9T0hXqEBRqZrNP3xiL/KEYRz
- TLSH T157F34A46FB408A17C0D62779B69F42463323DB6493EB73069928ABB43F8376E4E63505
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 784 bin.armv7l - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/9/maps bin.armv7l File opened for reading /proc/31/maps bin.armv7l File opened for reading /proc/56/maps bin.armv7l File opened for reading /proc/622/maps bin.armv7l File opened for reading /proc/35/maps bin.armv7l File opened for reading /proc/220/maps bin.armv7l File opened for reading /proc/673/maps bin.armv7l File opened for reading /proc/4/maps bin.armv7l File opened for reading /proc/30/maps bin.armv7l File opened for reading /proc/316/maps bin.armv7l File opened for reading /proc/366/maps bin.armv7l File opened for reading /proc/29/maps bin.armv7l File opened for reading /proc/2/maps bin.armv7l File opened for reading /proc/3/maps bin.armv7l File opened for reading /proc/8/maps bin.armv7l File opened for reading /proc/34/maps bin.armv7l File opened for reading /proc/242/maps bin.armv7l File opened for reading /proc/317/maps bin.armv7l File opened for reading /proc/10/maps bin.armv7l File opened for reading /proc/23/maps bin.armv7l File opened for reading /proc/351/maps bin.armv7l File opened for reading /proc/728/maps bin.armv7l File opened for reading /proc/21/maps bin.armv7l File opened for reading /proc/24/maps bin.armv7l File opened for reading /proc/142/maps bin.armv7l File opened for reading /proc/6/maps bin.armv7l File opened for reading /proc/11/maps bin.armv7l File opened for reading /proc/16/maps bin.armv7l File opened for reading /proc/17/maps bin.armv7l File opened for reading /proc/42/maps bin.armv7l File opened for reading /proc/143/maps bin.armv7l File opened for reading /proc/14/maps bin.armv7l File opened for reading /proc/45/maps bin.armv7l File opened for reading /proc/335/maps bin.armv7l File opened for reading /proc/355/maps bin.armv7l File opened for reading /proc/641/maps bin.armv7l File opened for reading /proc/5/maps bin.armv7l File opened for reading /proc/13/maps bin.armv7l File opened for reading /proc/32/maps bin.armv7l File opened for reading /proc/44/maps bin.armv7l File opened for reading /proc/197/maps bin.armv7l File opened for reading /proc/15/maps bin.armv7l File opened for reading /proc/199/maps bin.armv7l File opened for reading /proc/332/maps bin.armv7l File opened for reading /proc/7/maps bin.armv7l File opened for reading /proc/12/maps bin.armv7l File opened for reading /proc/22/maps bin.armv7l File opened for reading /proc/26/maps bin.armv7l File opened for reading /proc/28/maps bin.armv7l File opened for reading /proc/33/maps bin.armv7l File opened for reading /proc/782/maps bin.armv7l File opened for reading /proc/800/maps bin.armv7l File opened for reading /proc/18/maps bin.armv7l File opened for reading /proc/46/maps bin.armv7l File opened for reading /proc/193/maps bin.armv7l File opened for reading /proc/313/maps bin.armv7l File opened for reading /proc/339/maps bin.armv7l File opened for reading /proc/20/maps bin.armv7l File opened for reading /proc/25/maps bin.armv7l File opened for reading /proc/36/maps bin.armv7l File opened for reading /proc/19/maps bin.armv7l File opened for reading /proc/27/maps bin.armv7l File opened for reading /proc/51/maps bin.armv7l File opened for reading /proc/57/maps bin.armv7l - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself gpioc_daemon 784 bin.armv7l -
description ioc Process File opened for reading /proc/25/comm bin.armv7l File opened for reading /proc/56/comm bin.armv7l File opened for reading /proc/307/comm bin.armv7l File opened for reading /proc/641/comm bin.armv7l File opened for reading /proc/8/comm bin.armv7l File opened for reading /proc/29/comm bin.armv7l File opened for reading /proc/34/comm bin.armv7l File opened for reading /proc/197/comm bin.armv7l File opened for reading /proc/20/comm bin.armv7l File opened for reading /proc/21/comm bin.armv7l File opened for reading /proc/46/comm bin.armv7l File opened for reading /proc/51/comm bin.armv7l File opened for reading /proc/800/comm bin.armv7l File opened for reading /proc/13/comm bin.armv7l File opened for reading /proc/18/comm bin.armv7l File opened for reading /proc/19/comm bin.armv7l File opened for reading /proc/35/comm bin.armv7l File opened for reading /proc/42/comm bin.armv7l File opened for reading /proc/45/comm bin.armv7l File opened for reading /proc/73/comm bin.armv7l File opened for reading /proc/728/comm bin.armv7l File opened for reading /proc/3/comm bin.armv7l File opened for reading /proc/5/comm bin.armv7l File opened for reading /proc/22/comm bin.armv7l File opened for reading /proc/339/comm bin.armv7l File opened for reading /proc/733/comm bin.armv7l File opened for reading /proc/794/comm bin.armv7l File opened for reading /proc/795/comm bin.armv7l File opened for reading /proc/4/comm bin.armv7l File opened for reading /proc/11/comm bin.armv7l File opened for reading /proc/28/comm bin.armv7l File opened for reading /proc/32/comm bin.armv7l File opened for reading /proc/355/comm bin.armv7l File opened for reading /proc/770/comm bin.armv7l File opened for reading /proc/782/comm bin.armv7l File opened for reading /proc/17/comm bin.armv7l File opened for reading /proc/220/comm bin.armv7l File opened for reading /proc/316/comm bin.armv7l File opened for reading /proc/9/comm bin.armv7l File opened for reading /proc/193/comm bin.armv7l File opened for reading /proc/242/comm bin.armv7l File opened for reading /proc/783/comm bin.armv7l File opened for reading /proc/6/comm bin.armv7l File opened for reading /proc/27/comm bin.armv7l File opened for reading /proc/30/comm bin.armv7l File opened for reading /proc/31/comm bin.armv7l File opened for reading /proc/791/comm bin.armv7l File opened for reading /proc/26/comm bin.armv7l File opened for reading /proc/44/comm bin.armv7l File opened for reading /proc/142/comm bin.armv7l File opened for reading /proc/317/comm bin.armv7l File opened for reading /proc/366/comm bin.armv7l File opened for reading /proc/673/comm bin.armv7l File opened for reading /proc/786/comm bin.armv7l File opened for reading /proc/7/comm bin.armv7l File opened for reading /proc/24/comm bin.armv7l File opened for reading /proc/36/comm bin.armv7l File opened for reading /proc/57/comm bin.armv7l File opened for reading /proc/335/comm bin.armv7l File opened for reading /proc/785/comm bin.armv7l File opened for reading /proc/15/comm bin.armv7l File opened for reading /proc/313/comm bin.armv7l File opened for reading /proc/332/comm bin.armv7l File opened for reading /proc/351/comm bin.armv7l