Analysis
- max time kernel
141s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
30/07/2026, 19:40
Static task
static1
General
- Target armv7l.elf
- Size 123KB
- Sample260730-ydyn2sef59
- SHA256 d44edce44672d1c036650973eb16ae1398e7ae936c3000e8a1342e49d97cec6d
- MD5 e71b9864e8d5ae7c656bae11bdd20265
- SHA1 d0f20b421aab4c0e9509da7535fdee5c06a0f343
- SHA512 0bab57911b670083df14025db0ca92274a250b9c65d265b7728e5262dd05899e25e822b499052cb0b24affdf81b7e0e341de69bde849d1ee9884e436971bdee5
- SSDEEP 3072:lHIa1j/DrbwdTP2ukSahAzFX2XfVm1KyKbFvgkzyXk1:lr9bUTeZSah0FX2XfInKhvgkzyXk1
- TLSH T146C30649FD41AF01D5D635FEFA4E028933531BACE3FE7212AA245B2123CAA5B0F76505
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 792 armv7l.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/flylegit 792 armv7l.elf - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo armv7l.elf -
description ioc Process File opened for reading /proc/51/cmdline armv7l.elf File opened for reading /proc/623/cmdline armv7l.elf File opened for reading /proc/793/cmdline armv7l.elf File opened for reading /proc/15/comm armv7l.elf File opened for reading /proc/27/comm armv7l.elf File opened for reading /proc/18/comm armv7l.elf File opened for reading /proc/19/comm armv7l.elf File opened for reading /proc/768/comm armv7l.elf File opened for reading /proc/784/comm armv7l.elf File opened for reading /proc/24/cmdline armv7l.elf File opened for reading /proc/36/cmdline armv7l.elf File opened for reading /proc/676/cmdline armv7l.elf File opened for reading /proc/784/cmdline armv7l.elf File opened for reading /proc/27/cmdline armv7l.elf File opened for reading /proc/143/comm armv7l.elf File opened for reading /proc/642/comm armv7l.elf File opened for reading /proc/20/comm armv7l.elf File opened for reading /proc/44/comm armv7l.elf File opened for reading /proc/15/cmdline armv7l.elf File opened for reading /proc/201/cmdline armv7l.elf File opened for reading /proc/782/cmdline armv7l.elf File opened for reading /proc/785/cmdline armv7l.elf File opened for reading /proc/1/comm armv7l.elf File opened for reading /proc/25/comm armv7l.elf File opened for reading /proc/221/comm armv7l.elf File opened for reading /proc/357/cmdline armv7l.elf File opened for reading /proc/17/comm armv7l.elf File opened for reading /proc/142/comm armv7l.elf File opened for reading /proc/788/comm armv7l.elf File opened for reading /proc/9/cmdline armv7l.elf File opened for reading /proc/142/cmdline armv7l.elf File opened for reading /proc/318/cmdline armv7l.elf File opened for reading /proc/780/cmdline armv7l.elf File opened for reading /proc/343/comm armv7l.elf File opened for reading /proc/371/cmdline armv7l.elf File opened for reading /proc/35/comm armv7l.elf File opened for reading /proc/20/cmdline armv7l.elf File opened for reading /proc/44/cmdline armv7l.elf File opened for reading /proc/56/cmdline armv7l.elf File opened for reading /proc/11/comm armv7l.elf File opened for reading /proc/21/comm armv7l.elf File opened for reading /proc/143/cmdline armv7l.elf File opened for reading /proc/221/cmdline armv7l.elf File opened for reading /proc/4/comm armv7l.elf File opened for reading /proc/26/comm armv7l.elf File opened for reading /proc/7/cmdline armv7l.elf File opened for reading /proc/13/cmdline armv7l.elf File opened for reading /proc/244/cmdline armv7l.elf File opened for reading /proc/338/cmdline armv7l.elf File opened for reading /proc/735/cmdline armv7l.elf File opened for reading /proc/318/comm armv7l.elf File opened for reading /proc/32/comm armv7l.elf File opened for reading /proc/26/cmdline armv7l.elf File opened for reading /proc/30/cmdline armv7l.elf File opened for reading /proc/45/cmdline armv7l.elf File opened for reading /proc/6/cmdline armv7l.elf File opened for reading /proc/28/cmdline armv7l.elf File opened for reading /proc/782/comm armv7l.elf File opened for reading /proc/11/cmdline armv7l.elf File opened for reading /proc/23/cmdline armv7l.elf File opened for reading /proc/201/comm armv7l.elf File opened for reading /proc/623/comm armv7l.elf File opened for reading /proc/732/comm armv7l.elf File opened for reading /proc/10/cmdline armv7l.elf