Analysis
- max time kernel
149s - max time network
150s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
28/07/2026, 18:28
Static task
static1
Behavioral task
behavioral1
Sample
11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4
Resource
debian12-armhf-20260127-en
debian-12-armhf
4 signatures
150 seconds
General
- Target 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4
- Size 142KB
- Sample260728-w4jlpsseqe
- SHA256 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4
- MD5 ae5987b05f7673f002ed9c23e72456f1
- SHA1 bee0bb17e13bda1040398223cf1ad9998bf2ca96
- SHA512 59fce2737aff1568dbc0a2f4b08a6b9e3c953c3889f9c310b2f733be1e88c9e5a762c7e4e2d27da6fb1fcaf99ae594fc1cc811b8f1ff186d20d7b13716e57898
- SSDEEP 3072:0Q/ZRzm1O8ZE2SpE5TJSA/PmhdgxorVNyaRpCeGaECocONDdomm1hPYguL1V:0Q/ZRzm1O8ZE2cCJHYaxSXyazrGaECox
- TLSH T167E3F749ED42AB00D5D636FAFE4E428973534B6CE3FE71129E245B2167CAA1B0F7B101
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/xs.main 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself -sh 788 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 -
description ioc Process File opened for reading /proc/8/comm 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/8/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/14/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/73/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/1/comm 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/15/stat 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/19/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/29/stat 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/32/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/44/comm 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/44/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/286/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/779/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/15/comm 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/26/stat 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/29/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/33/stat 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/56/task/56/children 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/198/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/143/comm 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/20/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/31/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/296/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/641/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/785/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/51/comm 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/17/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/24/stat 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/142/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/796/stat 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/35/comm 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/8/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/360/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/334/comm 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/7/stat 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/29/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/142/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/13/comm 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/11/stat 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/15/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/73/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/286/stat 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/806/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/7/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/13/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/804/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/73/comm 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/788/stat 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/9/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/33/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/728/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/11/comm 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/26/comm 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/3/stat 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/10/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/12/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/800/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/357/comm 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/10/stat 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/16/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/31/status 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/16/stat 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/796/cmdline 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4 File opened for reading /proc/28/comm 11b3dd191bddcdb7da3057f53edbb745122de125f00289dcad40f56a1c028af4
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/init.d/xs.main
- Size 81B
- SHA256 af834fec6c70bc1236a8429922125942639fe34e0e534a38b2bf7840f1b174b4
- MD5 89a29268b9092889e00ab1e5a6b130c8
- SHA1 9b779caca2450a02bdfc701611eca794fc005848
- SHA512 8bc10be0adb13310563b53162320ea314e5af2d813f25a78a0e25cf9df143b705566f43301493f17242880510f4b0a8fac486c9f1df6886bd710028f8cfa2c79
- TLSH T149A0123C220100140665083014916690944140AD44077C50010E1266A038F03285A71A
- MD5 SHA1 SHA512 TLSH