Analysis
- max time kernel
145s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
24/05/2026, 18:46
Behavioral task
behavioral1
Sample
wife.arm7
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target wife.arm7
- Size 55KB
- Sample260524-xewemsgz4w
- SHA256 ae6e8d633bbb941e3cfa16aa96be1b11534251e4b50cae5e86999a587b44dc38
- MD5 91036f4aa13b8a863ef00cc3fe8e1db2
- SHA1 85efb0c2e2b8296add4b12f60f92d47efe6eaf89
- SHA512 1867a2e94e0c4b31f8e36da16e533f2036449a47acf8ad795ba5ca802fef7435c47043a71047c60b93f1841a48da6217cee3fa1306482524bddc72ea7d080b18
- SSDEEP 1536:X77m8Hbh3MuV/yhNS0AtduXjTweRYdiXE4MSiGqsVLs6xt1Lii:XPXquOQ0YduzTZYgTMSNfYA1Lii
- TLSH T15A430236C829ECC1CA92557A74E1412F5D948E78C3F3F3A65076698813FBD41BA32E52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/33/maps wife.arm7 File opened for reading /proc/142/maps wife.arm7 File opened for reading /proc/35/maps wife.arm7 File opened for reading /proc/57/maps wife.arm7 File opened for reading /proc/9/maps wife.arm7 File opened for reading /proc/17/maps wife.arm7 File opened for reading /proc/28/maps wife.arm7 File opened for reading /proc/46/maps wife.arm7 File opened for reading /proc/736/maps wife.arm7 File opened for reading /proc/830/maps wife.arm7 File opened for reading /proc/4/maps wife.arm7 File opened for reading /proc/51/maps wife.arm7 File opened for reading /proc/56/maps wife.arm7 File opened for reading /proc/355/maps wife.arm7 File opened for reading /proc/640/maps wife.arm7 File opened for reading /proc/19/maps wife.arm7 File opened for reading /proc/32/maps wife.arm7 File opened for reading /proc/622/maps wife.arm7 File opened for reading /proc/73/maps wife.arm7 File opened for reading /proc/333/maps wife.arm7 File opened for reading /proc/827/maps wife.arm7 File opened for reading /proc/29/maps wife.arm7 File opened for reading /proc/18/maps wife.arm7 File opened for reading /proc/25/maps wife.arm7 File opened for reading /proc/34/maps wife.arm7 File opened for reading /proc/143/maps wife.arm7 File opened for reading /proc/210/maps wife.arm7 File opened for reading /proc/7/maps wife.arm7 File opened for reading /proc/15/maps wife.arm7 File opened for reading /proc/16/maps wife.arm7 File opened for reading /proc/20/maps wife.arm7 File opened for reading /proc/27/maps wife.arm7 File opened for reading /proc/22/maps wife.arm7 File opened for reading /proc/30/maps wife.arm7 File opened for reading /proc/31/maps wife.arm7 File opened for reading /proc/318/maps wife.arm7 File opened for reading /proc/625/maps wife.arm7 File opened for reading /proc/641/maps wife.arm7 File opened for reading /proc/198/maps wife.arm7 File opened for reading /proc/2/maps wife.arm7 File opened for reading /proc/6/maps wife.arm7 File opened for reading /proc/8/maps wife.arm7 File opened for reading /proc/10/maps wife.arm7 File opened for reading /proc/24/maps wife.arm7 File opened for reading /proc/26/maps wife.arm7 File opened for reading /proc/193/maps wife.arm7 File opened for reading /proc/5/maps wife.arm7 File opened for reading /proc/11/maps wife.arm7 File opened for reading /proc/44/maps wife.arm7 File opened for reading /proc/677/maps wife.arm7 File opened for reading /proc/779/maps wife.arm7 File opened for reading /proc/821/maps wife.arm7 File opened for reading /proc/3/maps wife.arm7 File opened for reading /proc/14/maps wife.arm7 File opened for reading /proc/21/maps wife.arm7 File opened for reading /proc/42/maps wife.arm7 File opened for reading /proc/320/maps wife.arm7 File opened for reading /proc/329/maps wife.arm7 File opened for reading /proc/367/maps wife.arm7 File opened for reading /proc/806/maps wife.arm7 File opened for reading /proc/36/maps wife.arm7 File opened for reading /proc/308/maps wife.arm7 File opened for reading /proc/362/maps wife.arm7 File opened for reading /proc/672/maps wife.arm7 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself syslogd 819 wife.arm7 -
description ioc Process File opened for reading /proc/18/cmdline wife.arm7 File opened for reading /proc/36/cmdline wife.arm7 File opened for reading /proc/51/cmdline wife.arm7 File opened for reading /proc/830/cmdline wife.arm7 File opened for reading /proc/4/cmdline wife.arm7 File opened for reading /proc/6/cmdline wife.arm7 File opened for reading /proc/17/cmdline wife.arm7 File opened for reading /proc/28/cmdline wife.arm7 File opened for reading /proc/34/cmdline wife.arm7 File opened for reading /proc/142/cmdline wife.arm7 File opened for reading /proc/392/cmdline wife.arm7 File opened for reading /proc/806/cmdline wife.arm7 File opened for reading /proc/210/cmdline wife.arm7 File opened for reading /proc/318/cmdline wife.arm7 File opened for reading /proc/320/cmdline wife.arm7 File opened for reading /proc/9/cmdline wife.arm7 File opened for reading /proc/24/cmdline wife.arm7 File opened for reading /proc/25/cmdline wife.arm7 File opened for reading /proc/143/cmdline wife.arm7 File opened for reading /proc/198/cmdline wife.arm7 File opened for reading /proc/12/cmdline wife.arm7 File opened for reading /proc/22/cmdline wife.arm7 File opened for reading /proc/30/cmdline wife.arm7 File opened for reading /proc/355/cmdline wife.arm7 File opened for reading /proc/14/cmdline wife.arm7 File opened for reading /proc/16/cmdline wife.arm7 File opened for reading /proc/23/cmdline wife.arm7 File opened for reading /proc/362/cmdline wife.arm7 File opened for reading /proc/827/cmdline wife.arm7 File opened for reading /proc/8/cmdline wife.arm7 File opened for reading /proc/193/cmdline wife.arm7 File opened for reading /proc/308/cmdline wife.arm7 File opened for reading /proc/730/cmdline wife.arm7 File opened for reading /proc/736/cmdline wife.arm7 File opened for reading /proc/13/cmdline wife.arm7 File opened for reading /proc/19/cmdline wife.arm7 File opened for reading /proc/73/cmdline wife.arm7 File opened for reading /proc/329/cmdline wife.arm7 File opened for reading /proc/367/cmdline wife.arm7 File opened for reading /proc/2/cmdline wife.arm7 File opened for reading /proc/33/cmdline wife.arm7 File opened for reading /proc/255/cmdline wife.arm7 File opened for reading /proc/333/cmdline wife.arm7 File opened for reading /proc/829/cmdline wife.arm7 File opened for reading /proc/self/exe wife.arm7 File opened for reading /proc/5/cmdline wife.arm7 File opened for reading /proc/10/cmdline wife.arm7 File opened for reading /proc/21/cmdline wife.arm7 File opened for reading /proc/45/cmdline wife.arm7 File opened for reading /proc/625/cmdline wife.arm7 File opened for reading /proc/640/cmdline wife.arm7 File opened for reading /proc/677/cmdline wife.arm7 File opened for reading /proc/26/cmdline wife.arm7 File opened for reading /proc/42/cmdline wife.arm7 File opened for reading /proc/779/cmdline wife.arm7 File opened for reading /proc/20/cmdline wife.arm7 File opened for reading /proc/27/cmdline wife.arm7 File opened for reading /proc/29/cmdline wife.arm7 File opened for reading /proc/821/cmdline wife.arm7 File opened for reading /proc/3/cmdline wife.arm7 File opened for reading /proc/32/cmdline wife.arm7 File opened for reading /proc/622/cmdline wife.arm7 File opened for reading /proc/15/cmdline wife.arm7 File opened for reading /proc/35/cmdline wife.arm7