Analysis
- max time kernel
149s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
11/08/2026, 15:18
Static task
static1
Behavioral task
behavioral1
Sample
main.armv4tl.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
3 signatures
150 seconds
General
- Target main.armv4tl.elf
- Size 44KB
- Sample260811-spr3rafa45
- SHA256 f9f58078da3a55a466fe60c12558153b7385b8d72a4b9f4254cc2a351093e8a6
- MD5 fff275c12a97c4cd25519b332fc98ca6
- SHA1 1a12157985968457d94a81d3d09df25b295dfa25
- SHA512 1eadc808896017b16ce67b08efa1e78dff477fa592165615acd06acdaaf9e3f265c5a668af0db8617108b365d5b154693ecc33253ee38c51d8116cb3a1f57cba
- SSDEEP 768:jRndC4tXIvB//PfFpJUNUB3D0mEwVjZCY1kirY9fDltnOaVfgIz:jRnTlIvB/X/JzB3VDVjjkirYlDlt0Iz
- TLSH T1BA13F946FA519B05C6D232BAFB8E414E37136F68E7ED32319D306FE013826E71A39525
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/18/cmdline main.armv4tl.elf File opened for reading /proc/73/cmdline main.armv4tl.elf File opened for reading /proc/341/cmdline main.armv4tl.elf File opened for reading /proc/365/cmdline main.armv4tl.elf File opened for reading /proc/795/cmdline main.armv4tl.elf File opened for reading /proc/811/cmdline main.armv4tl.elf File opened for reading /proc/6/cmdline main.armv4tl.elf File opened for reading /proc/20/cmdline main.armv4tl.elf File opened for reading /proc/337/cmdline main.armv4tl.elf File opened for reading /proc/788/cmdline main.armv4tl.elf File opened for reading /proc/789/cmdline main.armv4tl.elf File opened for reading /proc/813/cmdline main.armv4tl.elf File opened for reading /proc/315/cmdline main.armv4tl.elf File opened for reading /proc/24/cmdline main.armv4tl.elf File opened for reading /proc/28/cmdline main.armv4tl.elf File opened for reading /proc/33/cmdline main.armv4tl.elf File opened for reading /proc/35/cmdline main.armv4tl.elf File opened for reading /proc/42/cmdline main.armv4tl.elf File opened for reading /proc/56/cmdline main.armv4tl.elf File opened for reading /proc/10/cmdline main.armv4tl.elf File opened for reading /proc/19/cmdline main.armv4tl.elf File opened for reading /proc/806/cmdline main.armv4tl.elf File opened for reading /proc/1/cmdline main.armv4tl.elf File opened for reading /proc/796/cmdline main.armv4tl.elf File opened for reading /proc/814/cmdline main.armv4tl.elf File opened for reading /proc/7/cmdline main.armv4tl.elf File opened for reading /proc/15/cmdline main.armv4tl.elf File opened for reading /proc/21/cmdline main.armv4tl.elf File opened for reading /proc/26/cmdline main.armv4tl.elf File opened for reading /proc/44/cmdline main.armv4tl.elf File opened for reading /proc/242/cmdline main.armv4tl.elf File opened for reading /proc/8/cmdline main.armv4tl.elf File opened for reading /proc/29/cmdline main.armv4tl.elf File opened for reading /proc/198/cmdline main.armv4tl.elf File opened for reading /proc/735/cmdline main.armv4tl.elf File opened for reading /proc/23/cmdline main.armv4tl.elf File opened for reading /proc/34/cmdline main.armv4tl.elf File opened for reading /proc/219/cmdline main.armv4tl.elf File opened for reading /proc/641/cmdline main.armv4tl.elf File opened for reading /proc/807/cmdline main.armv4tl.elf File opened for reading /proc/3/cmdline main.armv4tl.elf File opened for reading /proc/36/cmdline main.armv4tl.elf File opened for reading /proc/623/cmdline main.armv4tl.elf File opened for reading /proc/317/cmdline main.armv4tl.elf File opened for reading /proc/4/cmdline main.armv4tl.elf File opened for reading /proc/14/cmdline main.armv4tl.elf File opened for reading /proc/22/cmdline main.armv4tl.elf File opened for reading /proc/30/cmdline main.armv4tl.elf File opened for reading /proc/32/cmdline main.armv4tl.elf File opened for reading /proc/46/cmdline main.armv4tl.elf File opened for reading /proc/143/cmdline main.armv4tl.elf File opened for reading /proc/31/cmdline main.armv4tl.elf File opened for reading /proc/677/cmdline main.armv4tl.elf File opened for reading /proc/732/cmdline main.armv4tl.elf File opened for reading /proc/738/cmdline main.armv4tl.elf File opened for reading /proc/5/cmdline main.armv4tl.elf File opened for reading /proc/16/cmdline main.armv4tl.elf File opened for reading /proc/17/cmdline main.armv4tl.elf File opened for reading /proc/51/cmdline main.armv4tl.elf File opened for reading /proc/142/cmdline main.armv4tl.elf File opened for reading /proc/332/cmdline main.armv4tl.elf File opened for reading /proc/356/cmdline main.armv4tl.elf File opened for reading /proc/805/cmdline main.armv4tl.elf File opened for reading /proc/9/cmdline main.armv4tl.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.Kdat_tmp main.armv4tl.elf