Analysis
- max time kernel
133s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
14/08/2026, 12:29
Static task
static1
Behavioral task
behavioral1
Sample
linux_arm5
Resource
debian12-armhf-20260513-en
2 signatures
150 seconds
General
- Target linux_arm5
- Size 6.8MB
- Sample260814-pn4hlsshqf
- SHA256 81b62ed084960b77ced6210b582a75a7b5390ae6a51079d35eb5511a382425c1
- MD5 0f813f5630a469d3ffa9449839a5e2b1
- SHA1 739258656e487324baaae9631bbeeca25a6e7310
- SHA512 5647906b7852f0c9e17da6f996db0cc0f3f112905e170b2b39e04f71e7ced449066075a61f9dae35399cc17c210d37b8cb450a0395a9a8e84a86cef745c09e39
- SSDEEP 49152:wzHbUf9LOM6Kk5cftbS/vIAAZW99FkycQommlqLjlV+Niw2HtUfANqh5/JZ5EPy:6HM9Lftkq2Ht+v/tEa
- TLSH T1C4761AD7B9924882C4E43777A8FE80C432621EBA9F9612576D05FE3C3ABE1D91E35314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size linux_arm5 File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max linux_arm5 -
description ioc Process File opened for reading /proc/sys/net/core/somaxconn linux_arm5 File opened for reading /proc/filesystems mount File opened for reading /proc/self/mountinfo linux_arm5 File opened for reading /proc/self/cgroup linux_arm5
Processes
-
/tmp/linux_arm5/tmp/linux_arm51⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:784 -
/usr/bin/bashbash -c "mount -o bind /tmp/spoof /proc/784"2⤵PID:802
-
-
/usr/bin/mountmount -o bind /tmp/spoof /proc/7842⤵
- Reads runtime system information
PID:802
-