Analysis
- max time kernel
148s - max time network
153s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
20/06/2026, 00:16
Static task
static1
Behavioral task
behavioral1
Sample
armv5l
Resource
debian12-armhf-20260127-en
debian-12-armhf
4 signatures
150 seconds
General
- Target armv5l
- Size 6.9MB
- Sample260620-akyevsdv7s
- SHA256 a032bafefddb44e4ff6f01afd52731a711e1acb233dc341e938549b27f1feea1
- MD5 65f49d3ef9c78b5298ae67c467f8477d
- SHA1 9cc979e693089e8ca5c092397fa06de7c7539e4f
- SHA512 6768be2f38793975d9c1880cce9a820e766d69bc4fa7060e7ed46d5d1b3175a2c023ab5f8f8bb71ab10e93928672f1634cd8c8be0d833b439b1a6e1202d7c70b
- SSDEEP 49152:z08hZ6rFS1XBgrwZUJrQVcpxjqGzqEP6rPv0Gv/bOsEoOpbu3I015ES:YLGX2EqJrQVcpxjx6TRbOsEosi3nLES
- TLSH T1B6762997B8D24942C4E43A77B8BE80C432631EBA8BC712576D05EE383EBE5D90E35754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/sbin/cron 785 armv5l - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size armv5l -
description ioc Process File opened for reading /proc/self/auxv armv5l File opened for reading /proc/141/environ armv5l File opened for reading /proc/19/stat armv5l File opened for reading /proc/2/stat armv5l File opened for reading /proc/21/stat armv5l File opened for reading /proc/32/stat armv5l File opened for reading /proc/42/stat armv5l File opened for reading /proc/7/environ armv5l File opened for reading /proc/141/stat armv5l File opened for reading /proc/17/environ armv5l File opened for reading /proc/18/stat armv5l File opened for reading /proc/196/environ armv5l File opened for reading /proc/25/environ armv5l File opened for reading /proc/56/environ armv5l File opened for reading /proc/775/environ armv5l File opened for reading /proc/196/stat armv5l File opened for reading /proc/2/environ armv5l File opened for reading /proc/20/environ armv5l File opened for reading /proc/57/environ armv5l File opened for reading /proc/17/stat armv5l File opened for reading /proc/11/stat armv5l File opened for reading /proc/12/stat armv5l File opened for reading /proc/15/environ armv5l File opened for reading /proc/36/environ armv5l File opened for reading /proc/46/stat armv5l File opened for reading /proc/56/stat armv5l File opened for reading /proc/6/stat armv5l File opened for reading /proc/12/environ armv5l File opened for reading /proc/219/stat armv5l File opened for reading /proc/28/stat armv5l File opened for reading /proc/34/environ armv5l File opened for reading /proc/34/stat armv5l File opened for reading /proc/774/environ armv5l File opened for reading /proc/14/stat armv5l File opened for reading /proc/24/stat armv5l File opened for reading /proc/30/environ armv5l File opened for reading /proc/30/stat armv5l File opened for reading /proc/32/environ armv5l File opened for reading /proc/51/stat armv5l File opened for reading /proc/6/environ armv5l File opened for reading /proc/140/stat armv5l File opened for reading /proc/24/environ armv5l File opened for reading /proc/29/environ armv5l File opened for reading /proc/29/stat armv5l File opened for reading /proc/35/environ armv5l File opened for reading /proc/35/stat armv5l File opened for reading /proc/42/environ armv5l File opened for reading /proc/5/environ armv5l File opened for reading /proc/19/environ armv5l File opened for reading /proc/13/environ armv5l File opened for reading /proc/16/environ armv5l File opened for reading /proc/3/environ armv5l File opened for reading /proc/33/environ armv5l File opened for reading /proc/36/stat armv5l File opened for reading /proc/5/stat armv5l File opened for reading /proc/775/stat armv5l File opened for reading /proc/15/stat armv5l File opened for reading /proc/44/stat armv5l File opened for reading /proc/57/stat armv5l File opened for reading /proc/7/stat armv5l File opened for reading /proc/761/stat armv5l File opened for reading /proc/720/environ armv5l File opened for reading /proc/720/stat armv5l File opened for reading /proc/219/environ armv5l