Analysis
- max time kernel
132s - max time network
135s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
28/05/2026, 12:18
Behavioral task
behavioral1
Sample
bioset0
Resource
debian12-armhf-20260513-en
debian-12-armhf
5 signatures
150 seconds
General
- Target bioset0
- Size 1.7MB
- Sample260528-pg46kae12j
- SHA256 d761125d9f9454380a1d55d3aa69d3ad405bfed73af1dea74e98a2c84ae77c77
- MD5 3d03a3308a6ec70dac2740a0318d5d4e
- SHA1 50782981317c2614209a3586cd30356b15225259
- SHA512 7e0a9c63eb93e0f56bf8d145e4db21086dc27d018744fe54a873850e1f224035492a28d3e2d62bd06c7e136fab280fa25a9324b51bf83153814324f8539c4048
- SSDEEP 49152:8aWM+RGwd78yeXEa71/IC9Kd7BaoP01/f:pW3VzadKd7BaoO
- TLSH T158853360ED93C493C0BF1DF8082748D82BA6485D55B10036B4A0CA6A3E9FED0EEFD55B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 1.0.0.1 - Enumerates running processes
Discovers information about currently running processes on the system
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size bioset0 -
description ioc Process File opened for reading /proc/13/cmdline bioset0 File opened for reading /proc/15/cmdline bioset0 File opened for reading /proc/198/cmdline bioset0 File opened for reading /proc/322/cmdline bioset0 File opened for reading /proc/324/cmdline bioset0 File opened for reading /proc/356/cmdline bioset0 File opened for reading /proc/5/cmdline bioset0 File opened for reading /proc/21/cmdline bioset0 File opened for reading /proc/730/cmdline bioset0 File opened for reading /proc/788/cmdline bioset0 File opened for reading /proc/240/cmdline bioset0 File opened for reading /proc/311/cmdline bioset0 File opened for reading /proc/333/cmdline bioset0 File opened for reading /proc/336/cmdline bioset0 File opened for reading /proc/9/cmdline bioset0 File opened for reading /proc/16/cmdline bioset0 File opened for reading /proc/27/cmdline bioset0 File opened for reading /proc/31/cmdline bioset0 File opened for reading /proc/36/cmdline bioset0 File opened for reading /proc/44/cmdline bioset0 File opened for reading /proc/765/cmdline bioset0 File opened for reading /proc/796/cmdline bioset0 File opened for reading /proc/17/cmdline bioset0 File opened for reading /proc/669/cmdline bioset0 File opened for reading /proc/779/cmdline bioset0 File opened for reading /proc/784/cmdline bioset0 File opened for reading /proc/45/cmdline bioset0 File opened for reading /proc/56/cmdline bioset0 File opened for reading /proc/42/cmdline bioset0 File opened for reading /proc/51/cmdline bioset0 File opened for reading /proc/self/exe bioset0 File opened for reading /proc/12/cmdline bioset0 File opened for reading /proc/14/cmdline bioset0 File opened for reading /proc/2/cmdline bioset0 File opened for reading /proc/239/cmdline bioset0 File opened for reading /proc/389/cmdline bioset0 File opened for reading /proc/4/cmdline bioset0 File opened for reading /proc/73/cmdline bioset0 File opened for reading /proc/23/cmdline bioset0 File opened for reading /proc/33/cmdline bioset0 File opened for reading /proc/57/cmdline bioset0 File opened for reading /proc/6/cmdline bioset0 File opened for reading /proc/643/cmdline bioset0 File opened for reading /proc/11/cmdline bioset0 File opened for reading /proc/19/cmdline bioset0 File opened for reading /proc/212/cmdline bioset0 File opened for reading /proc/34/cmdline bioset0 File opened for reading /proc/7/cmdline bioset0 File opened for reading /proc/735/cmdline bioset0 File opened for reading /proc/29/cmdline bioset0 File opened for reading /proc/369/cmdline bioset0 File opened for reading /proc/46/cmdline bioset0 File opened for reading /proc/785/cmdline bioset0 File opened for reading /proc/8/cmdline bioset0 File opened for reading /proc/142/cmdline bioset0 File opened for reading /proc/18/cmdline bioset0 File opened for reading /proc/30/cmdline bioset0 File opened for reading /proc/32/cmdline bioset0 File opened for reading /proc/35/cmdline bioset0 File opened for reading /proc/675/cmdline bioset0 File opened for reading /proc/783/cmdline bioset0 File opened for reading /proc/789/cmdline bioset0 File opened for reading /proc/193/cmdline bioset0 File opened for reading /proc/26/cmdline bioset0 - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.ICE-unix/.ICEauth bioset0 File opened for modification /tmp/.font-unix/.font0-lock bioset0
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.ICE-unix/.ICEauth
- Size 4B
- SHA256 9c54d509a75f7fd1b75bda9d09cd6783ccb81cc8dc153bd51b82e1fe0b5824a7
- MD5 a79ee65cd688636c5a0f3fca4f567108
- SHA1 9046331fdbf6133bcd279e5257637d7bbd173433
- SHA512 56f75e66d062eb27de4320afd6606ad28ce275ae6afb4826255241148318924a73dac3b3afecb715b4e07e26205216bd1699728597b6acbac01b0c3dc33ac623
- MD5 SHA1 SHA512
- Path /tmp/.font-unix/.font0-lock
- Size 3B
- SHA256 82607c98dec8f45ac84e7eae445d8da60d05706ee7405a9a53b0c914b488f1ab
- MD5 c15da1f2b5e5ed6e6837a3802f0d1593
- SHA1 0fe36dcdec420a26d899a03ecd0f9bec4fa850fe
- SHA512 0d449e529998d4c014ec48a1bf23b3539e52764ad90a142c611a7a8a2182e78b48dd3c3adb79f2a109b1a6e565cdd9b7efc66bc74440a908f36a9c1302b60284
- MD5 SHA1 SHA512