Analysis
- max time kernel
149s - max time network
146s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
21/08/2026, 12:12
Static task
static1
Behavioral task
behavioral1
Sample
armv6l
Resource
debian12-armhf-20260513-en
debian-12-armhf
5 signatures
150 seconds
General
- Target armv6l
- Size 7.1MB
- Sample260821-pdndmszblh
- SHA256 377a086f0ce6b33bf749b8201a0dcdb0794ab6dc34c00381fc1dee8ca62fc4ee
- MD5 1d99abde05b9c63051713b822153c250
- SHA1 e2d3780981c1b758ab573dd6dbf99e1198d2e678
- SHA512 16d6f6f7a820a9d27b92db1daffd7956e91f782265a80d0c0c6e91e3eecd0bc3d47ab04d3396eeb010616cc60a297ff890b6e1dd123bfc865b7544fc2f471eaa
- SSDEEP 49152:oIU/xzhs0fPkuhRtDO8Jno3WA1s5CP0hpfU6L5E8s:hU/xzh9fPkCRtDO8JnDwPwpfTE8s
- TLSH T151762A57B8A24942C5E43A77B8BE81C433630EB99B8756576D05FE383EBE1D90E39340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/lib/udisks2/udisksd 796 armv6l - Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size armv6l File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max armv6l -
description ioc Process File opened for reading /proc/30/stat armv6l File opened for reading /proc/32/environ armv6l File opened for reading /proc/16/stat armv6l File opened for reading /proc/24/stat armv6l File opened for reading /proc/25/stat armv6l File opened for reading /proc/27/stat armv6l File opened for reading /proc/32/stat armv6l File opened for reading /proc/33/stat armv6l File opened for reading /proc/4/environ armv6l File opened for reading /proc/42/stat armv6l File opened for reading /proc/21/stat armv6l File opened for reading /proc/29/stat armv6l File opened for reading /proc/34/stat armv6l File opened for reading /proc/44/stat armv6l File opened for reading /proc/7/environ armv6l File opened for reading /proc/73/environ armv6l File opened for reading /proc/784/environ armv6l File opened for reading /proc/198/stat armv6l File opened for reading /proc/200/stat armv6l File opened for reading /proc/36/stat armv6l File opened for reading /proc/44/environ armv6l File opened for reading /proc/45/stat armv6l File opened for reading /proc/57/stat armv6l File opened for reading /proc/780/environ armv6l File opened for reading /proc/8/stat armv6l File opened for reading /proc/self/mountinfo armv6l File opened for reading /proc/12/stat armv6l File opened for reading /proc/14/environ armv6l File opened for reading /proc/15/stat armv6l File opened for reading /proc/16/environ armv6l File opened for reading /proc/17/stat armv6l File opened for reading /proc/22/stat armv6l File opened for reading /proc/24/environ armv6l File opened for reading /proc/22/environ armv6l File opened for reading /proc/25/environ armv6l File opened for reading /proc/28/stat armv6l File opened for reading /proc/33/environ armv6l File opened for reading /proc/4/stat armv6l File opened for reading /proc/5/environ armv6l File opened for reading /proc/51/environ armv6l File opened for reading /proc/73/stat armv6l File opened for reading /proc/143/stat armv6l File opened for reading /proc/19/environ armv6l File opened for reading /proc/56/environ armv6l File opened for reading /proc/6/stat armv6l File opened for reading /proc/790/environ armv6l File opened for reading /proc/790/stat armv6l File opened for reading /proc/803/environ armv6l File opened for reading /proc/803/stat armv6l File opened for reading /proc/13/stat armv6l File opened for reading /proc/198/environ armv6l File opened for reading /proc/29/environ armv6l File opened for reading /proc/35/environ armv6l File opened for reading /proc/784/stat armv6l File opened for reading /proc/9/environ armv6l File opened for reading /proc/self/cgroup armv6l File opened for reading /proc/10/environ armv6l File opened for reading /proc/11/environ armv6l File opened for reading /proc/11/stat armv6l File opened for reading /proc/19/stat armv6l File opened for reading /proc/20/stat armv6l File opened for reading /proc/30/environ armv6l File opened for reading /proc/31/environ armv6l File opened for reading /proc/46/stat armv6l - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.x11-unix-socket armv6l
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.x11-unix-socket
- Size 1B
- SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
- MD5 c4ca4238a0b923820dcc509a6f75849b
- SHA1 356a192b7913b04c54574d18c28d46e6395428ab
- SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
- MD5 SHA1 SHA512