Analysis
- max time kernel
148s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
02/06/2026, 06:02
Static task
static1
Behavioral task
behavioral1
Sample
arm7.elf
Resource
debian12-armhf-20260127-en
debian-12-armhf
3 signatures
150 seconds
General
- Target arm7.elf
- Size 106KB
- Sample260602-grmp9sew5x
- SHA256 378610d8625004953e60be2d43f5d7389bcce6cd765b9dfbcc029aad379155b6
- MD5 eeedaf9c1b7c7006078b318409d46e13
- SHA1 20ec0a579fb21f0d1ff65d2f5fedc1126660dfbb
- SHA512 ac6fb27944b1b6708e7b0b025d8b6d9db64c31c597261cdbbeb62c07b75422ecdbb417dd073e52d0573d23d30d308988deefb76391848b1f0be9ecb28ce0d11c
- SSDEEP 3072:5uqBK/jCrf+9AfQuSOJKzoH3t/a6wYqORDpJAucZUv:MqBK/Sf++xKsXt/a6wYqORFJ4s
- TLSH T1BFB3294ABC819B15D4D622BFFE4E118933136BA8E3EE7112DE245F2423CA65B0F77442
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Reads process memory 1 TTPs 13 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/33/maps arm7.elf File opened for reading /proc/111/maps arm7.elf File opened for reading /proc/444/maps arm7.elf File opened for reading /proc/555/maps arm7.elf File opened for reading /proc/11/maps arm7.elf File opened for reading /proc/44/maps arm7.elf File opened for reading /proc/55/maps arm7.elf File opened for reading /proc/66/maps arm7.elf File opened for reading /proc/77/maps arm7.elf File opened for reading /proc/88/maps arm7.elf File opened for reading /proc/222/maps arm7.elf File opened for reading /proc/333/maps arm7.elf File opened for reading /proc/22/maps arm7.elf - Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself bash 785 arm7.elf Changes the process name, possibly in an attempt to hide itself bash 785 arm7.elf -
description ioc Process File opened for reading /proc/333s�/maps arm7.elf File opened for reading /proc/555s�/maps arm7.elf File opened for reading /proc/1111�2/maps arm7.elf File opened for reading /proc/2222x4/maps arm7.elf File opened for reading /proc/6666i8/maps arm7.elf File opened for reading /proc/7777�;/maps arm7.elf File opened for reading /proc/111uq/maps arm7.elf File opened for reading /proc/111c{/maps arm7.elf File opened for reading /proc/222}/maps arm7.elf File opened for reading /proc/333�/maps arm7.elf File opened for reading /proc/333�/maps arm7.elf File opened for reading /proc/3333�;/maps arm7.elf File opened for reading /proc/6666�;/maps arm7.elf File opened for reading /proc/7777_;/maps arm7.elf File opened for reading /proc/111s/maps arm7.elf File opened for reading /proc/222c�/maps arm7.elf File opened for reading /proc/1111�/maps arm7.elf File opened for reading /proc/3333�4/maps arm7.elf File opened for reading /proc/6666R8/maps arm7.elf File opened for reading /proc/6666);/maps arm7.elf File opened for reading /proc/7777�;/maps arm7.elf File opened for reading /proc/7777�;/maps arm7.elf File opened for reading /proc/222�/maps arm7.elf File opened for reading /proc/444d�/maps arm7.elf File opened for reading /proc/1111�;/maps arm7.elf File opened for reading /proc/3333�4/maps arm7.elf File opened for reading /proc/99ssg/maps arm7.elf File opened for reading /proc/111i/maps arm7.elf File opened for reading /proc/222l�/maps arm7.elf File opened for reading /proc/333s�/maps arm7.elf File opened for reading /proc/3333B5/maps arm7.elf File opened for reading /proc/222v�/maps arm7.elf File opened for reading /proc/3333fffffff/maps arm7.elf File opened for reading /proc/3333 5/maps arm7.elf File opened for reading /proc/777k�/maps arm7.elf File opened for reading /proc/1111�1/maps arm7.elf File opened for reading /proc/3333O5/maps arm7.elf File opened for reading /proc/3333_5/maps arm7.elf File opened for reading /proc/6666_7/maps arm7.elf File opened for reading /proc/6666w7/maps arm7.elf File opened for reading /proc/7777�;/maps arm7.elf File opened for reading /proc/111cy/maps arm7.elf File opened for reading /proc/222m�/maps arm7.elf File opened for reading /proc/2222�3/maps arm7.elf File opened for reading /proc/7777�;/maps arm7.elf File opened for reading /proc/7777�;/maps arm7.elf File opened for reading /proc/7777/maps arm7.elf File opened for reading /proc/3333o4/maps arm7.elf