Analysis
- max time kernel
141s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
10/07/2026, 02:15
General
- Target b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6
- Size 132KB
- Sample260710-cpybrsds2x
- SHA256 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6
- MD5 40a44f123157bd6fc9ff79794f887232
- SHA1 f2252da96ef8562e0f3f60285d82fd9c2d67d6c2
- SHA512 fae63f6bd1b8a9994b38924696f72c926d67583b22fd8b95523372b261de03930584b53d4f14d5d58e77076830b2943fe416b5d6f5bd112359a92195553451fd
- SSDEEP 3072:UY+3OS15mqV5O4nnPfGxKCEk7bUBbaVYScU0UlElEfMKV0KebMoC:TS1tLnPexKCEOb+baVYScUrElEr0XIoC
- TLSH T1BAD32A46AD425A12D5D732FAFAAE408933137F79E3FA7102DD205F5023C9A9B0E77612
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Traces itself 20 IoCs
Traces itself to prevent debugging attempts
pid Process 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 - Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself uhttpd 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 Changes the process name, possibly in an attempt to hide itself lighttpd 785 b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 -
description ioc Process File opened for reading /proc/mounts b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6 File opened for reading /proc/self/status b407d1ef1d10163c41f45abc40399f1e3e301b2929d05a6ab313b2670e873ac6