040b95e8c50d9241d71038cfe3d06876b280243f59694314271c7dd619ce83db

Analysis

max time kernel
149s
max time network
127s
platform
debian-12_armhf
resource
debian12-armhf-20260127-en
resource tags

arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
22/06/2026, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
candy.arm7
Size 172KB
Sample260622-bpc56ahs2x
SHA256 040b95e8c50d9241d71038cfe3d06876b280243f59694314271c7dd619ce83db
MD5 95ee6f425a7e185c0372374461450706
SHA1 a8bb5d708fd6743001cdfe40283cbb7b53750dd5
SHA512 127807913ce944a0f03f6aa519a4ee937f218cfcfd3b2394e9f663787be945f7a8f2505f3b6238af75f1ffb1190c38cf83be0f53fbdaff728b5a3d856f76c6e4
SSDEEP 3072:iZYS4d9BuME7xQbRbo5El2pJ0LIq7J+8qpnIvkb02T2imoJaELqC87ZPHpAS/F:iZY/daME7xQbRs5Y2pqLIq7JVqpnIvX3
TLSH
T1BD043A86FD809B5BC5D167BDFFAD9389332627B8D2DF7113D8289725378D00A4E2A604
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm discovery persistence

Malware Config

Signatures

Traces itself 5 IoCs

Traces itself to prevent debugging attempts

pid	Process
796	candy.arm7
838	candy.arm7
907	candy.arm7
920	candy.arm7
933	candy.arm7

Enumerates running processes
Discovers information about currently running processes on the system

Write file to user bin folder 5 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/sbin/ksoftirq	candy.arm7
File opened for modification	/usr/sbin/ksoftirq	candy.arm7
File opened for modification	/usr/sbin/ksoftirq	candy.arm7
File opened for modification	/usr/sbin/ksoftirq	candy.arm7
File opened for modification	/usr/sbin/ksoftirq	candy.arm7

Changes its process name 5 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	[kworker/u0:1H]	796	candy.arm7
Changes the process name, possibly in an attempt to hide itself	[kworker/u0:1H]	838	candy.arm7
Changes the process name, possibly in an attempt to hide itself	[kworker/u0:2H]	907	candy.arm7
Changes the process name, possibly in an attempt to hide itself	[kworker/u0:0H]	920	candy.arm7
Changes the process name, possibly in an attempt to hide itself	[kworker/u0:1H]	933	candy.arm7

Checks CPU configuration 1 TTPs 5 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	candy.arm7
File opened for reading	/proc/cpuinfo	candy.arm7
File opened for reading	/proc/cpuinfo	candy.arm7
File opened for reading	/proc/cpuinfo	candy.arm7
File opened for reading	/proc/cpuinfo	candy.arm7

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/366/exe	candy.arm7
File opened for reading	/proc/809/comm	candy.arm7
File opened for reading	/proc/851/oom_score	candy.arm7
File opened for reading	/proc/218/cmdline	candy.arm7
File opened for reading	/proc/45/oom_score	candy.arm7
File opened for reading	/proc/641/stat	candy.arm7
File opened for reading	/proc/850/comm	candy.arm7
File opened for reading	/proc/898/comm	candy.arm7
File opened for reading	/proc/26/stat	candy.arm7
File opened for reading	/proc/5/comm	candy.arm7
File opened for reading	/proc/19/comm	candy.arm7
File opened for reading	/proc/198/oom_score	candy.arm7
File opened for reading	/proc/316/cmdline	candy.arm7
File opened for reading	/proc/912/oom_score	candy.arm7
File opened for reading	/proc/193/oom_score	candy.arm7
File opened for reading	/proc/729/oom_score	candy.arm7
File opened for reading	/proc/316/stat	candy.arm7
File opened for reading	/proc/200/oom_score	candy.arm7
File opened for reading	/proc/56/comm	candy.arm7
File opened for reading	/proc/16/comm	candy.arm7
File opened for reading	/proc/800/stat	candy.arm7
File opened for reading	/proc/315/stat	candy.arm7
File opened for reading	/proc/842/comm	candy.arm7
File opened for reading	/proc/843/stat	candy.arm7
File opened for reading	/proc/797/comm	candy.arm7
File opened for reading	/proc/331/stat	candy.arm7
File opened for reading	/proc/811/oom_score	candy.arm7
File opened for reading	/proc/23/oom_score	candy.arm7
File opened for reading	/proc/799/stat	candy.arm7
File opened for reading	/proc/879/stat	candy.arm7
File opened for reading	/proc/919/oom_score	candy.arm7
File opened for reading	/proc/913/comm	candy.arm7
File opened for reading	/proc/15/stat	candy.arm7
File opened for reading	/proc/336/cmdline	candy.arm7
File opened for reading	/proc/143/comm	candy.arm7
File opened for reading	/proc/912/comm	candy.arm7
File opened for reading	/proc/27/comm	candy.arm7
File opened for reading	/proc/20/stat	candy.arm7
File opened for reading	/proc/641/exe	candy.arm7
File opened for reading	/proc/51/oom_score	candy.arm7
File opened for reading	/proc/20/comm	candy.arm7
File opened for reading	/proc/809/comm	candy.arm7
File opened for reading	/proc/142/stat	candy.arm7
File opened for reading	/proc/912/oom_score	candy.arm7
File opened for reading	/proc/51/oom_score	candy.arm7
File opened for reading	/proc/24/stat	candy.arm7
File opened for reading	/proc/1/stat	candy.arm7
File opened for reading	/proc/5/oom_score	candy.arm7
File opened for reading	/proc/931/stat	candy.arm7
File opened for reading	/proc/9/comm	candy.arm7
File opened for reading	/proc/4/stat	candy.arm7
File opened for reading	/proc/22/stat	candy.arm7
File opened for reading	/proc/16/comm	candy.arm7
File opened for reading	/proc/670/stat	candy.arm7
File opened for reading	/proc/846/comm	candy.arm7
File opened for reading	/proc/882/comm	candy.arm7
File opened for reading	/proc/914/comm	candy.arm7
File opened for reading	/proc/18/stat	candy.arm7
File opened for reading	/proc/34/comm	candy.arm7
File opened for reading	/proc/921/stat	candy.arm7
File opened for reading	/proc/28/comm	candy.arm7
File opened for reading	/proc/14/oom_score	candy.arm7
File opened for reading	/proc/859/cmdline	candy.arm7
File opened for reading	/proc/871/comm	candy.arm7

/tmp/candy.arm7
/tmp/candy.arm7
1⤵
- Traces itself
- Write file to user bin folder
- Changes its process name
- Checks CPU configuration
- Reads runtime system information
PID:790

/tmp/candy.arm7
/tmp/candy.arm7
1⤵
- Traces itself
- Write file to user bin folder
- Changes its process name
- Checks CPU configuration
- Reads runtime system information
PID:804

/tmp/candy.arm7
/tmp/candy.arm7
1⤵
- Traces itself
- Write file to user bin folder
- Changes its process name
- Checks CPU configuration
- Reads runtime system information
PID:848

/tmp/candy.arm7
/tmp/candy.arm7
1⤵
- Traces itself
- Write file to user bin folder
- Changes its process name
- Checks CPU configuration
- Reads runtime system information
PID:915

/tmp/candy.arm7
/tmp/candy.arm7
1⤵
- Traces itself
- Write file to user bin folder
- Changes its process name
- Checks CPU configuration
- Reads runtime system information
PID:928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ksoftirq

Path /usr/sbin/ksoftirq
Size 172KB
SHA256 040b95e8c50d9241d71038cfe3d06876b280243f59694314271c7dd619ce83db
MD5 95ee6f425a7e185c0372374461450706
SHA1 a8bb5d708fd6743001cdfe40283cbb7b53750dd5
SHA512 127807913ce944a0f03f6aa519a4ee937f218cfcfd3b2394e9f663787be945f7a8f2505f3b6238af75f1ffb1190c38cf83be0f53fbdaff728b5a3d856f76c6e4
SSDEEP 3072:iZYS4d9BuME7xQbRbo5El2pJ0LIq7J+8qpnIvkb02T2imoJaELqC87ZPHpAS/F:iZY/daME7xQbRs5Y2pqLIq7JVqpnIvX3
TLSH
T1BD043A86FD809B5BC5D167BDFFAD9389332627B8D2DF7113D8289725378D00A4E2A604
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads