Analysis
- max time kernel
149s - max time network
139s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
04/08/2026, 12:21
Behavioral task
behavioral1
Sample
arm7
Resource
debian12-armhf-20260127-en
debian-12-armhf
6 signatures
150 seconds
General
- Target arm7
- Size 168KB
- Sample260804-pjdrdsem5y
- SHA256 f7be5b76f4d34cb064557bf6392debf71d1b3448af63c7e99c24495722980cf0
- MD5 c3b169a9a75ab954c23f857e9aba088c
- SHA1 2c3d143901092d233ee8906c2ceb02e7ae70c269
- SHA512 0de684aef50a9d554587369626369971954ab4690a7d60a794c4819e2e22b7285991fd156c1215c193470de404c3eb7ee59717b7db413419e0afe1bca05b8ddc
- SSDEEP 3072:ido3QYaZF3Ewtarhg/TA6Bww9yqPOF+VveS4x262/M/9gepAmqS7YStQ6:VQYaZNEwtay/Tww9ZPOUVve9x26iM/9d
- TLSH T15DF32B46EA418B53C0D61BB9FB9F824533239B24D7A763059928BFF43F4279E4E27205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
description ioc Process File deleted /var/log/audit/audit.log arm7 - Deletes itself 1 IoCs
pid Process 784 arm7 - Deletes journal logs 1 TTPs 1 IoCs
Deletes systemd journal logs. Likely to evade detection.
description ioc Process File deleted /var/log/journal/65779e181e584f059cb9deb1099989c3/system.journal arm7 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself [kworker/u4:0] 784 arm7 -
description ioc Process File opened for reading /proc/8/cmdline arm7 File opened for reading /proc/17/cmdline arm7 File opened for reading /proc/20/stat arm7 File opened for reading /proc/22/stat arm7 File opened for reading /proc/33/stat arm7 File opened for reading /proc/44/cmdline arm7 File opened for reading /proc/664/stat arm7 File opened for reading /proc/776/cmdline arm7 File opened for reading /proc/13/cmdline arm7 File opened for reading /proc/42/stat arm7 File opened for reading /proc/45/cmdline arm7 File opened for reading /proc/331/cmdline arm7 File opened for reading /proc/888/cmdline arm7 File opened for reading /proc/1078/stat arm7 File opened for reading /proc/1149/stat arm7 File opened for reading /proc/1256/cmdline arm7 File opened for reading /proc/26/stat arm7 File opened for reading /proc/35/stat arm7 File opened for reading /proc/46/stat arm7 File opened for reading /proc/331/stat arm7 File opened for reading /proc/921/cmdline arm7 File opened for reading /proc/1258/stat arm7 File opened for reading /proc/1383/stat arm7 File opened for reading /proc/1385/stat arm7 File opened for reading /proc/6/cmdline arm7 File opened for reading /proc/642/stat arm7 File opened for reading /proc/731/cmdline arm7 File opened for reading /proc/775/stat arm7 File opened for reading /proc/1024/cmdline arm7 File opened for reading /proc/1148/cmdline arm7 File opened for reading /proc/1518/stat arm7 File opened for reading /proc/18/stat arm7 File opened for reading /proc/56/stat arm7 File opened for reading /proc/352/cmdline arm7 File opened for reading /proc/728/cmdline arm7 File opened for reading /proc/782/stat arm7 File opened for reading /proc/10/stat arm7 File opened for reading /proc/19/cmdline arm7 File opened for reading /proc/198/stat arm7 File opened for reading /proc/218/cmdline arm7 File opened for reading /proc/641/stat arm7 File opened for reading /proc/734/stat arm7 File opened for reading /proc/817/cmdline arm7 File opened for reading /proc/36/stat arm7 File opened for reading /proc/355/cmdline arm7 File opened for reading /proc/728/stat arm7 File opened for reading /proc/776/stat arm7 File opened for reading /proc/920/cmdline arm7 File opened for reading /proc/12/stat arm7 File opened for reading /proc/1256/stat arm7 File opened for reading /proc/16/stat arm7 File opened for reading /proc/24/cmdline arm7 File opened for reading /proc/193/stat arm7 File opened for reading /proc/641/cmdline arm7 File opened for reading /proc/835/stat arm7 File opened for reading /proc/920/stat arm7 File opened for reading /proc/4/cmdline arm7 File opened for reading /proc/22/cmdline arm7 File opened for reading /proc/25/cmdline arm7 File opened for reading /proc/828/cmdline arm7 File opened for reading /proc/1257/cmdline arm7 File opened for reading /proc/1518/cmdline arm7 File opened for reading /proc/1519/stat arm7 File opened for reading /proc/9/stat arm7