c865bf8e60d1774a4d5637d035651bb4b589e958235b12dd60a317b9f3c3d750

Analysis

max time kernel
132s
max time network
153s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
14/08/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
linux_arm7
Size 6.8MB
Sample260814-pn445sshrd
SHA256 c865bf8e60d1774a4d5637d035651bb4b589e958235b12dd60a317b9f3c3d750
MD5 c123fe3823803ae55b6f5d1eb4e70c86
SHA1 a6b5649ce4adabc775b2188a8458717eb2cac9c4
SHA512 a1f718bff98a87b71cf7824686fab11b7980115600487d9944f8840fd05ebe5763a3e75698fd189274e345ce9222619750fd36b4846cefdc589095134ea13b3e
SSDEEP 49152:WCzegw80bzbT72Vb1RLSX0PNW5mwXnR13E5Kii5ohpoMHvtyZ5EGD:WCIvT727ReXCi5rMHvgEK
TLSH
T1286628D7B8914942C4E83777A8BE80C872631EBA9B9652176D05FE3C3EBE1D90E35704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	linux_arm7
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	linux_arm7

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/self/mountinfo	linux_arm7
File opened for reading	/proc/self/cgroup	linux_arm7
File opened for reading	/proc/sys/net/core/somaxconn	linux_arm7

/tmp/linux_arm7
/tmp/linux_arm7
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:778
- /usr/bin/bash
  bash -c "mount -o bind /tmp/spoof /proc/778"
  2⤵
  PID:803
- /usr/bin/mount
  mount -o bind /tmp/spoof /proc/778
  2⤵
  - Reads runtime system information
  PID:803

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads