Analysis
- max time kernel
149s - max time network
153s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
20/06/2026, 00:16
Static task
static1
Behavioral task
behavioral1
Sample
armv7l
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target armv7l
- Size 6.9MB
- Sample260620-akyevsdv61
- SHA256 a2ddbfd8ecc410a2c28e4087cefb720d8064f7488e2d2979cbd31729c8340257
- MD5 15942680614d928f198cda1600450a88
- SHA1 7c1478841b3ac26fefb61ca6dbb9ad9abdee5491
- SHA512 062a0bb1b788ef865629c768c2c79a7d6dd0f1e79f0a926e82eab628bc482d23d18c78ea148866d718548bee9012fc83e545bae05a852bcba7398270fefd43c0
- SSDEEP 49152:ni3936vcofw4yTYpLRjcmeY5er9HZ1sLHkEh/+MtB1dr+54c+5Eu:ni4vN/RTeY5er9H22yr+54PEu
- TLSH T1AD762A57B8D24982C4E43A77B8BE81C433630EBA9BC716576D05EE383ABE1D90E35744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/sbin/rsyslogd 793 armv7l - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size armv7l -
description ioc Process File opened for reading /proc/29/stat armv7l File opened for reading /proc/7/environ armv7l File opened for reading /proc/73/stat armv7l File opened for reading /proc/8/stat armv7l File opened for reading /proc/11/environ armv7l File opened for reading /proc/32/environ armv7l File opened for reading /proc/33/environ armv7l File opened for reading /proc/33/stat armv7l File opened for reading /proc/35/environ armv7l File opened for reading /proc/36/stat armv7l File opened for reading /proc/46/stat armv7l File opened for reading /proc/6/environ armv7l File opened for reading /proc/20/stat armv7l File opened for reading /proc/11/stat armv7l File opened for reading /proc/12/environ armv7l File opened for reading /proc/14/stat armv7l File opened for reading /proc/624/environ armv7l File opened for reading /proc/781/stat armv7l File opened for reading /proc/783/environ armv7l File opened for reading /proc/24/stat armv7l File opened for reading /proc/25/environ armv7l File opened for reading /proc/29/environ armv7l File opened for reading /proc/3/environ armv7l File opened for reading /proc/56/environ armv7l File opened for reading /proc/143/environ armv7l File opened for reading /proc/17/stat armv7l File opened for reading /proc/198/stat armv7l File opened for reading /proc/10/stat armv7l File opened for reading /proc/23/stat armv7l File opened for reading /proc/26/environ armv7l File opened for reading /proc/2/environ armv7l File opened for reading /proc/4/stat armv7l File opened for reading /proc/44/stat armv7l File opened for reading /proc/7/stat armv7l File opened for reading /proc/9/environ armv7l File opened for reading /proc/21/stat armv7l File opened for reading /proc/22/stat armv7l File opened for reading /proc/31/environ armv7l File opened for reading /proc/31/stat armv7l File opened for reading /proc/34/stat armv7l File opened for reading /proc/35/stat armv7l File opened for reading /proc/198/environ armv7l File opened for reading /proc/21/environ armv7l File opened for reading /proc/24/environ armv7l File opened for reading /proc/34/environ armv7l File opened for reading /proc/56/stat armv7l File opened for reading /proc/768/stat armv7l File opened for reading /proc/781/environ armv7l File opened for reading /proc/17/environ armv7l File opened for reading /proc/25/stat armv7l File opened for reading /proc/30/stat armv7l File opened for reading /proc/624/stat armv7l File opened for reading /proc/768/environ armv7l File opened for reading /proc/783/stat armv7l File opened for reading /proc/15/stat armv7l File opened for reading /proc/2/stat armv7l File opened for reading /proc/28/stat armv7l File opened for reading /proc/16/stat armv7l File opened for reading /proc/19/stat armv7l File opened for reading /proc/142/stat armv7l File opened for reading /proc/self/auxv armv7l File opened for reading /proc/14/environ armv7l File opened for reading /proc/28/environ armv7l File opened for reading /proc/36/environ armv7l