Analysis
- max time kernel
28s - max time network
42s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
20/07/2026, 10:41
Static task
static1
Behavioral task
behavioral1
Sample
tarm7
Resource
debian12-armhf-20260513-en
debian-12-armhf
5 signatures
40 seconds
General
- Target tarm7
- Size 111KB
- Sample260720-mrcsyshw8x
- SHA256 98253ed6c9bfb2f61fe97d17952f2b07c01bd64802d385fcd1c09a6384b06b30
- MD5 1d4f3a84e36806c0036a41b6c6bdce17
- SHA1 7a27aa6bca1682881eb02dd6e56afeeb2f2a1602
- SHA512 bdd72e06e005bd786d4461271284dbcb4aa7f039f24cc71f55a99d0c269f261a49b55ae958f06d363634c9789cd492f08a9f848589be401fff2e8797f3ff3523
- SSDEEP 3072:TMppCy1CKodLVCitmUeOV+JIG1/aXUj9f6hHx4u3n4Cw0:TM/3odYisUbMIc/aXUj9f6xxlp
- TLSH T1D2B3198AB8816B25D2C326BBFE5F014E33574BA8D3EA72129D144F7077CA95B0E37605
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Contacts a large (20995) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself sleep 1 787 tarm7 -
description ioc Process File opened for reading /proc/58/stat tarm7 File opened for reading /proc/12/cmdline tarm7 File opened for reading /proc/30/cmdline tarm7 File opened for reading /proc/194/cmdline tarm7 File opened for reading /proc/643/cmdline tarm7 File opened for reading /proc/43/stat tarm7 File opened for reading /proc/52/stat tarm7 File opened for reading /proc/627/stat tarm7 File opened for reading /proc/644/cmdline tarm7 File opened for reading /proc/9/stat tarm7 File opened for reading /proc/27/stat tarm7 File opened for reading /proc/144/stat tarm7 File opened for reading /proc/785/stat tarm7 File opened for reading /proc/808/cmdline tarm7 File opened for reading /proc/57/cmdline tarm7 File opened for reading /proc/313/cmdline tarm7 File opened for reading /proc/335/cmdline tarm7 File opened for reading /proc/12/stat tarm7 File opened for reading /proc/20/stat tarm7 File opened for reading /proc/217/stat tarm7 File opened for reading /proc/770/stat tarm7 File opened for reading /proc/809/cmdline tarm7 File opened for reading /proc/4/cmdline tarm7 File opened for reading /proc/8/cmdline tarm7 File opened for reading /proc/32/stat tarm7 File opened for reading /proc/46/stat tarm7 File opened for reading /proc/356/stat tarm7 File opened for reading /proc/34/cmdline tarm7 File opened for reading /proc/45/cmdline tarm7 File opened for reading /proc/791/cmdline tarm7 File opened for reading /proc/33/stat tarm7 File opened for reading /proc/373/stat tarm7 File opened for reading /proc/643/stat tarm7 File opened for reading /proc/15/cmdline tarm7 File opened for reading /proc/35/cmdline tarm7 File opened for reading /proc/373/cmdline tarm7 File opened for reading /proc/784/cmdline tarm7 File opened for reading /proc/788/stat tarm7 File opened for reading /proc/809/stat tarm7 File opened for reading /proc/20/cmdline tarm7 File opened for reading /proc/356/cmdline tarm7 File opened for reading /proc/25/stat tarm7 File opened for reading /proc/735/stat tarm7 File opened for reading /proc/804/cmdline tarm7 File opened for reading /proc/807/cmdline tarm7 File opened for reading /proc/810/cmdline tarm7 File opened for reading /proc/9/cmdline tarm7 File opened for reading /proc/627/cmdline tarm7 File opened for reading /proc/26/stat tarm7 File opened for reading /proc/16/cmdline tarm7 File opened for reading /proc/732/cmdline tarm7 File opened for reading /proc/24/stat tarm7 File opened for reading /proc/19/cmdline tarm7 File opened for reading /proc/684/cmdline tarm7 File opened for reading /proc/18/stat tarm7 File opened for reading /proc/36/stat tarm7 File opened for reading /proc/33/cmdline tarm7 File opened for reading /proc/361/cmdline tarm7 File opened for reading /proc/21/stat tarm7 File opened for reading /proc/729/stat tarm7 File opened for reading /proc/791/stat tarm7 File opened for reading /proc/317/cmdline tarm7 File opened for reading /proc/786/cmdline tarm7 File opened for reading /proc/14/stat tarm7