Analysis
- max time kernel
149s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
23/05/2026, 15:18
Static task
static1
Behavioral task
behavioral1
Sample
bin.armv6l
Resource
debian12-armhf-20260513-en
debian-12-armhf
5 signatures
150 seconds
General
- Target bin.armv6l
- Size 165KB
- Sample260523-spsz2set6w
- SHA256 a0fe9dfa134bd67a3d81053eaffe2e2e6e1e4c5a66e4de7acbe8b148301ff293
- MD5 0d4827018243f11ffa6cf7633f86de56
- SHA1 8f002dc5ed3d01af84c5989b73c901ad2f380cc5
- SHA512 a6bdb0166eb8529db0586de05ff80e958c44162f0cc5b8b7801f777d0ecac910067ea048af5ae1acc3365066da20de2a8eccc87ad2bf6e7b4e35843f7d8cd3c4
- SSDEEP 3072:GVKi6pcaEgSuAaTsYkjUk9K18a6k+6S/cCI7ar984Ts7:Xi6pcaEgS3a5uz9K76k+tcCjTs7
- TLSH T197F32B06EF428A57C4C20779BA9F43553323EBA893DB73039A18BB742F837D90E66515
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 786 bin.armv6l - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/357/maps bin.armv6l File opened for reading /proc/381/maps bin.armv6l File opened for reading /proc/360/maps bin.armv6l File opened for reading /proc/19/maps bin.armv6l File opened for reading /proc/30/maps bin.armv6l File opened for reading /proc/32/maps bin.armv6l File opened for reading /proc/46/maps bin.armv6l File opened for reading /proc/794/maps bin.armv6l File opened for reading /proc/13/maps bin.armv6l File opened for reading /proc/14/maps bin.armv6l File opened for reading /proc/335/maps bin.armv6l File opened for reading /proc/15/maps bin.armv6l File opened for reading /proc/33/maps bin.armv6l File opened for reading /proc/7/maps bin.armv6l File opened for reading /proc/9/maps bin.armv6l File opened for reading /proc/27/maps bin.armv6l File opened for reading /proc/280/maps bin.armv6l File opened for reading /proc/292/maps bin.armv6l File opened for reading /proc/368/maps bin.armv6l File opened for reading /proc/623/maps bin.armv6l File opened for reading /proc/643/maps bin.armv6l File opened for reading /proc/20/maps bin.armv6l File opened for reading /proc/56/maps bin.armv6l File opened for reading /proc/676/maps bin.armv6l File opened for reading /proc/728/maps bin.armv6l File opened for reading /proc/12/maps bin.armv6l File opened for reading /proc/21/maps bin.armv6l File opened for reading /proc/28/maps bin.armv6l File opened for reading /proc/73/maps bin.armv6l File opened for reading /proc/783/maps bin.armv6l File opened for reading /proc/4/maps bin.armv6l File opened for reading /proc/10/maps bin.armv6l File opened for reading /proc/25/maps bin.armv6l File opened for reading /proc/29/maps bin.armv6l File opened for reading /proc/51/maps bin.armv6l File opened for reading /proc/2/maps bin.armv6l File opened for reading /proc/22/maps bin.armv6l File opened for reading /proc/36/maps bin.armv6l File opened for reading /proc/42/maps bin.armv6l File opened for reading /proc/34/maps bin.armv6l File opened for reading /proc/44/maps bin.armv6l File opened for reading /proc/11/maps bin.armv6l File opened for reading /proc/24/maps bin.armv6l File opened for reading /proc/35/maps bin.armv6l File opened for reading /proc/5/maps bin.armv6l File opened for reading /proc/8/maps bin.armv6l File opened for reading /proc/359/maps bin.armv6l File opened for reading /proc/371/maps bin.armv6l File opened for reading /proc/57/maps bin.armv6l File opened for reading /proc/143/maps bin.armv6l File opened for reading /proc/193/maps bin.armv6l File opened for reading /proc/198/maps bin.armv6l File opened for reading /proc/208/maps bin.armv6l File opened for reading /proc/3/maps bin.armv6l File opened for reading /proc/17/maps bin.armv6l File opened for reading /proc/26/maps bin.armv6l File opened for reading /proc/31/maps bin.armv6l File opened for reading /proc/45/maps bin.armv6l File opened for reading /proc/142/maps bin.armv6l File opened for reading /proc/211/maps bin.armv6l File opened for reading /proc/333/maps bin.armv6l File opened for reading /proc/16/maps bin.armv6l File opened for reading /proc/18/maps bin.armv6l File opened for reading /proc/642/maps bin.armv6l - Changes its process name 6 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself gpioc_daemon 799 bin.armv6l Changes the process name, possibly in an attempt to hide itself gpioc_daemon 799 bin.armv6l Changes the process name, possibly in an attempt to hide itself gpioc_daemon 799 bin.armv6l Changes the process name, possibly in an attempt to hide itself gpioc_daemon 799 bin.armv6l Changes the process name, possibly in an attempt to hide itself gpioc_daemon 799 bin.armv6l Changes the process name, possibly in an attempt to hide itself gpioc_daemon 799 bin.armv6l -
description ioc Process File opened for reading /proc/17/comm bin.armv6l File opened for reading /proc/24/comm bin.armv6l File opened for reading /proc/25/comm bin.armv6l File opened for reading /proc/142/comm bin.armv6l File opened for reading /proc/330/comm bin.armv6l File opened for reading /proc/681/comm bin.armv6l File opened for reading /proc/787/comm bin.armv6l File opened for reading /proc/meminfo bin.armv6l File opened for reading /proc/5/comm bin.armv6l File opened for reading /proc/42/comm bin.armv6l File opened for reading /proc/73/comm bin.armv6l File opened for reading /proc/292/comm bin.armv6l File opened for reading /proc/623/comm bin.armv6l File opened for reading /proc/676/comm bin.armv6l File opened for reading /proc/23/comm bin.armv6l File opened for reading /proc/6/comm bin.armv6l File opened for reading /proc/33/comm bin.armv6l File opened for reading /proc/728/comm bin.armv6l File opened for reading /proc/stat bin.armv6l File opened for reading /proc/10/comm bin.armv6l File opened for reading /proc/22/comm bin.armv6l File opened for reading /proc/36/comm bin.armv6l File opened for reading /proc/46/comm bin.armv6l File opened for reading /proc/357/comm bin.armv6l File opened for reading /proc/642/comm bin.armv6l File opened for reading /proc/794/comm bin.armv6l File opened for reading /proc/14/comm bin.armv6l File opened for reading /proc/782/comm bin.armv6l File opened for reading /proc/2/comm bin.armv6l File opened for reading /proc/34/comm bin.armv6l File opened for reading /proc/193/comm bin.armv6l File opened for reading /proc/211/comm bin.armv6l File opened for reading /proc/360/comm bin.armv6l File opened for reading /proc/783/comm bin.armv6l File opened for reading /proc/799/comm bin.armv6l File opened for reading /proc/29/comm bin.armv6l File opened for reading /proc/32/comm bin.armv6l File opened for reading /proc/44/comm bin.armv6l File opened for reading /proc/198/comm bin.armv6l File opened for reading /proc/13/comm bin.armv6l File opened for reading /proc/18/comm bin.armv6l File opened for reading /proc/781/comm bin.armv6l File opened for reading /proc/8/comm bin.armv6l File opened for reading /proc/28/comm bin.armv6l File opened for reading /proc/51/comm bin.armv6l File opened for reading /proc/335/comm bin.armv6l File opened for reading /proc/368/comm bin.armv6l File opened for reading /proc/643/comm bin.armv6l File opened for reading /proc/20/comm bin.armv6l File opened for reading /proc/56/comm bin.armv6l File opened for reading /proc/333/comm bin.armv6l File opened for reading /proc/371/comm bin.armv6l File opened for reading /proc/729/comm bin.armv6l File opened for reading /proc/26/comm bin.armv6l File opened for reading /proc/3/comm bin.armv6l File opened for reading /proc/7/comm bin.armv6l File opened for reading /proc/9/comm bin.armv6l File opened for reading /proc/12/comm bin.armv6l File opened for reading /proc/733/comm bin.armv6l File opened for reading /proc/31/comm bin.armv6l File opened for reading /proc/45/comm bin.armv6l File opened for reading /proc/771/comm bin.armv6l File opened for reading /proc/27/comm bin.armv6l File opened for reading /proc/4/comm bin.armv6l