8a3f9b24c385d2532d5039e95ad913b96b8bff389211f9bfa1718af35d95dab9

Resubmissions

10/08/2026, 10:31

260810-mkb8vafn2s6

10/08/2026, 10:28

260810-mhtp4swhla6

10/08/2026, 10:25

260810-mf12eawgpg6

Analysis

user interaction
yes
max time kernel
109s
max time network
112s
platform
debian-12_armhf
resource
debian12-armhf-20260127-en
resource tags

arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
10/08/2026, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
arm7
Size 248KB
Sample260810-mf12eawgpg
SHA256 8a3f9b24c385d2532d5039e95ad913b96b8bff389211f9bfa1718af35d95dab9
MD5 f33ee4d5146e13687053014e42efc44e
SHA1 cdcfeaa20d74d146fcfc1f29b218b838e576c29c
SHA512 ffbe390b17672da39813c7a5267d5ddd32b8d0df2821b57fcb92224292f83601df134b1836b1b42cb22f5405ed394ee8cffd82a223f68df54cf5f26c7c5796e0
SSDEEP 6144:8XS43ddoIppa1qW/vHaiKs7nIaUA0qW3/:YoagAir7Iat0qWP
TLSH
T1CB44FAB6FD429941C5D42AFAFB1ED2C833035378E3D97112AD068B25A5CF54E4E3EA81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	[kworker/u:1]	792	arm7

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/786/stat	arm7
File opened for reading	/proc/791/stat	arm7
File opened for reading	/proc/734/comm	arm7
File opened for reading	/proc/320/stat	arm7
File opened for reading	/proc/345/stat	arm7
File opened for reading	/proc/626/stat	arm7
File opened for reading	/proc/787/comm	arm7
File opened for reading	/proc/787/exe	arm7
File opened for reading	/proc/337/stat	arm7
File opened for reading	/proc/356/stat	arm7
File opened for reading	/proc/787/stat	arm7
File opened for reading	/proc/802/exe	arm7
File opened for reading	/proc/813/comm	arm7
File opened for reading	/proc/811/comm	arm7
File opened for reading	/proc/817/exe	arm7
File opened for reading	/proc/819/stat	arm7
File opened for reading	/proc/644/comm	arm7
File opened for reading	/proc/814/comm	arm7
File opened for reading	/proc/816/comm	arm7
File opened for reading	/proc/824/exe	arm7
File opened for reading	/proc/830/comm	arm7
File opened for reading	/proc/198/stat	arm7
File opened for reading	/proc/790/comm	arm7
File opened for reading	/proc/802/comm	arm7
File opened for reading	/proc/806/stat	arm7
File opened for reading	/proc/816/exe	arm7
File opened for reading	/proc/824/comm	arm7
File opened for reading	/proc/626/exe	arm7
File opened for reading	/proc/203/stat	arm7
File opened for reading	/proc/737/comm	arm7
File opened for reading	/proc/800/exe	arm7
File opened for reading	/proc/805/comm	arm7
File opened for reading	/proc/807/exe	arm7
File opened for reading	/proc/810/stat	arm7
File opened for reading	/proc/826/stat	arm7
File opened for reading	/proc/734/stat	arm7
File opened for reading	/proc/798/exe	arm7
File opened for reading	/proc/810/comm	arm7
File opened for reading	/proc/813/exe	arm7
File opened for reading	/proc/817/comm	arm7
File opened for reading	/proc/818/stat	arm7
File opened for reading	/proc/820/exe	arm7
File opened for reading	/proc/829/comm	arm7
File opened for reading	/proc/802/stat	arm7
File opened for reading	/proc/816/stat	arm7
File opened for reading	/proc/830/stat	arm7
File opened for reading	/proc/798/comm	arm7
File opened for reading	/proc/808/comm	arm7
File opened for reading	/proc/342/stat	arm7
File opened for reading	/proc/193/stat	arm7
File opened for reading	/proc/820/stat	arm7
File opened for reading	/proc/828/comm	arm7
File opened for reading	/proc/832/stat	arm7
File opened for reading	/proc/643/stat	arm7
File opened for reading	/proc/676/exe	arm7
File opened for reading	/proc/788/stat	arm7
File opened for reading	/proc/786/exe	arm7
File opened for reading	/proc/814/exe	arm7
File opened for reading	/proc/831/stat	arm7
File opened for reading	/proc/832/exe	arm7
File opened for reading	/proc/812/comm	arm7
File opened for reading	/proc/826/exe	arm7
File opened for reading	/proc/379/stat	arm7
File opened for reading	/proc/683/exe	arm7

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.hwid_id	arm7

/tmp/arm7
/tmp/arm7 massload
1⤵
- Changes its process name
- Reads runtime system information
- Writes file to tmp directory
PID:789

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

.hwid_id

Path /tmp/.hwid_id
Size 33B
SHA256 291d0b3370c1426bbdf8eb6dcbe1c00d452192672fd92cb7a07e96f4f198b60a
MD5 7a134fa17d78c6bac787f2dea1d1225f
SHA1 63a38544df48a67a6bc9405a5ac3c7e61499d8ae
SHA512 7636a4b88a85e1315408fe6cdc01cfa07a1628f06276f10993f57fcbaddc302ad0d4300ef2e1e6ac17d07e7f4dba7cfa8c12f18bb47a0b462f581d81ba67a8c6
MD5 SHA1 SHA512

Submit Download