Analysis
- max time kernel
148s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20250619-en - resource tags
arch:armhfimage:debian12-armhf-20250619-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
09/05/2026, 23:19
Static task
static1
Behavioral task
behavioral1
Sample
94.156.152.234_8080_sample.bin
Resource
debian12-armhf-20250619-en
debian-12-armhf
4 signatures
150 seconds
General
- Target 94.156.152.234_8080_sample.bin
- Size 7.1MB
- Sample260509-3avv7set5t
- SHA256 ead2b70788df7c71a50fa204ab0c5db80963f2366f4bcf70aba99bfb031ab849
- MD5 74a80a6c75c0a6bfcd46af9b4b9330bf
- SHA1 2b1937837319bc670b00e405f6c33959a54f0c22
- SHA512 c7fea4f727678f14c55967d71d2022620858067aaa8a11cbfb56d1e2d9b67627c3c0addfcd5cfa529c7a26bedb7b1571b49c35d2a8a0b5bbb50bf892c10b399c
- SSDEEP 49152:uj4YFzE6VnFZ2y+I7fdNaFBaR12N/hqCHvmOznhmJ4PGQ5Ez:o06VnFZ2VI7fdNwBaRwZPmWnhlEz
- TLSH T16F762957B9924942C4E43A77B8BE81C433630EBD9B8716579D05EE383EBE1DA0E39740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/lib/accountsservice/accounts-daemon 801 94.156.152.234_8080_sample.bin - Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size 94.156.152.234_8080_sample.bin File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max 94.156.152.234_8080_sample.bin -
description ioc Process File opened for reading /proc/27/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/29/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/31/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/5/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/198/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/2/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/20/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/34/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/4/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/42/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/6/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/28/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/3/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/self/cgroup 94.156.152.234_8080_sample.bin File opened for reading /proc/17/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/30/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/35/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/5/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/786/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/13/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/27/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/44/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/56/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/57/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/9/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/12/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/13/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/22/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/24/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/26/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/33/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/51/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/142/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/19/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/24/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/33/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/9/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/21/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/22/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/25/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/26/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/35/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/46/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/7/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/14/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/208/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/32/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/51/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/6/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/772/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/785/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/8/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/14/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/143/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/15/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/15/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/20/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/29/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/32/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/46/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/self/mountinfo 94.156.152.234_8080_sample.bin File opened for reading /proc/142/environ 94.156.152.234_8080_sample.bin File opened for reading /proc/143/stat 94.156.152.234_8080_sample.bin File opened for reading /proc/18/environ 94.156.152.234_8080_sample.bin