Analysis
- max time kernel
149s - max time network
154s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
28/05/2026, 13:12
Static task
static1
Behavioral task
behavioral1
Sample
iran.armv7l.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target iran.armv7l.elf
- Size 101KB
- Sample260528-qfvfeahv7s
- SHA256 c292a9501c815c6de3bda6e2afe6119cc7d71bb064a121033b3ef94841dd18f2
- MD5 2fbb34e501f340b751336dfe9759d45f
- SHA1 406e5136a38f57420743078afe924165231e5ef9
- SHA512 471d5b72cef756a6d10f8eed913e88398bd62233d22960e4d7c6869844e3f46dd40b2de400af669e97dc6e8a1719b141cf34601972546268eb39b714d0bb83dc
- SSDEEP 3072:xonrHQmNGQhemIha7NAldl/8CQyTK/ZE:xonrxGQIxha7NAldxCy2/Z
- TLSH T1C2A3F649FD416B10E9D635FAFA4F024933934B6CE3FA7101AA245B3123CAA6B0F76516
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 787 iran.armv7l.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/flylegit 787 iran.armv7l.elf -
description ioc Process File opened for reading /proc/143/comm iran.armv7l.elf File opened for reading /proc/624/comm iran.armv7l.elf File opened for reading /proc/11/cmdline iran.armv7l.elf File opened for reading /proc/32/fd iran.armv7l.elf File opened for reading /proc/321/cmdline iran.armv7l.elf File opened for reading /proc/367/comm iran.armv7l.elf File opened for reading /proc/20/stat iran.armv7l.elf File opened for reading /proc/26/cmdline iran.armv7l.elf File opened for reading /proc/11/comm iran.armv7l.elf File opened for reading /proc/33/stat iran.armv7l.elf File opened for reading /proc/73/cmdline iran.armv7l.elf File opened for reading /proc/28/comm iran.armv7l.elf File opened for reading /proc/3/cmdline iran.armv7l.elf File opened for reading /proc/7/cmdline iran.armv7l.elf File opened for reading /proc/46/comm iran.armv7l.elf File opened for reading /proc/641/comm iran.armv7l.elf File opened for reading /proc/22/stat iran.armv7l.elf File opened for reading /proc/35/fd iran.armv7l.elf File opened for reading /proc/36/stat iran.armv7l.elf File opened for reading /proc/14/cmdline iran.armv7l.elf File opened for reading /proc/324/cmdline iran.armv7l.elf File opened for reading /proc/780/stat iran.armv7l.elf File opened for reading /proc/44/comm iran.armv7l.elf File opened for reading /proc/216/comm iran.armv7l.elf File opened for reading /proc/4/fd iran.armv7l.elf File opened for reading /proc/35/stat iran.armv7l.elf File opened for reading /proc/20/comm iran.armv7l.elf File opened for reading /proc/56/comm iran.armv7l.elf File opened for reading /proc/45/fd iran.armv7l.elf File opened for reading /proc/363/comm iran.armv7l.elf File opened for reading /proc/18/stat iran.armv7l.elf File opened for reading /proc/29/cmdline iran.armv7l.elf File opened for reading /proc/32/cmdline iran.armv7l.elf File opened for reading /proc/42/cmdline iran.armv7l.elf File opened for reading /proc/16/comm iran.armv7l.elf File opened for reading /proc/51/comm iran.armv7l.elf File opened for reading /proc/321/comm iran.armv7l.elf File opened for reading /proc/23/fd iran.armv7l.elf File opened for reading /proc/27/cmdline iran.armv7l.elf File opened for reading /proc/14/comm iran.armv7l.elf File opened for reading /proc/622/cmdline iran.armv7l.elf File opened for reading /proc/2/fd iran.armv7l.elf File opened for reading /proc/15/fd iran.armv7l.elf File opened for reading /proc/391/cmdline iran.armv7l.elf File opened for reading /proc/1/comm iran.armv7l.elf File opened for reading /proc/13/comm iran.armv7l.elf File opened for reading /proc/732/comm iran.armv7l.elf File opened for reading /proc/44/stat iran.armv7l.elf File opened for reading /proc/46/stat iran.armv7l.elf File opened for reading /proc/198/fd iran.armv7l.elf File opened for reading /proc/642/cmdline iran.armv7l.elf File opened for reading /proc/25/comm iran.armv7l.elf File opened for reading /proc/10/fd iran.armv7l.elf File opened for reading /proc/13/fd iran.armv7l.elf File opened for reading /proc/2/comm iran.armv7l.elf File opened for reading /proc/45/comm iran.armv7l.elf File opened for reading /proc/677/comm iran.armv7l.elf File opened for reading /proc/4/stat iran.armv7l.elf File opened for reading /proc/765/cmdline iran.armv7l.elf File opened for reading /proc/18/comm iran.armv7l.elf File opened for reading /proc/779/stat iran.armv7l.elf File opened for reading /proc/15/comm iran.armv7l.elf File opened for reading /proc/34/comm iran.armv7l.elf File opened for reading /proc/73/stat iran.armv7l.elf