Analysis
- max time kernel
0s - max time network
148s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
23/08/2026, 19:18
Static task
static1
General
- Target ntb.armv7
- Size 89KB
- Sample260823-xz7cmsam21
- SHA256 b8e6875d15a5c910fa97cc128c2271ef91a92d17db96cf340aa67f871126d203
- MD5 a3c5bb38a9127d49527f0c390e7e9975
- SHA1 e8f8701f9bf4410dfc1be1bd651001ea56ff58df
- SHA512 8e88ee271669f0fb8260a5eab968eb35039bf054755ad6c78df37a9fc439a62c93c0d6337dcfc9ca1c45221693c6c6d10fb5cfde11ffc962535de8232b4eada7
- SSDEEP 1536:vvjl7EX3tQFr0HGmvBRCWcpCrb65HMrxhc8jDCef7Wy6e:vvjl7g33GQRCW9Sc9fSa
- TLSH T13A931251CF4ECE365624F17322145559F2CEB624A03CBA1BA3788F844DF58932B7FA68
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Traces itself 3 IoCs
Traces itself to prevent debugging attempts
pid Process 788 ntb.armv7 790 ntb.armv7 791 ntb.armv7 - Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/class/dmi/id/product_name ntb.armv7 - Enumerates running processes
Discovers information about currently running processes on the system
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo ntb.armv7 -
description ioc Process File opened for reading /proc/784/comm ntb.armv7 File opened for reading /proc/self/exe ntb.armv7 File opened for reading /proc/4/comm ntb.armv7 File opened for reading /proc/643/comm ntb.armv7 File opened for reading /proc/644/comm ntb.armv7 File opened for reading /proc/735/comm ntb.armv7 File opened for reading /proc/self/cmdline ntb.armv7 File opened for reading /proc/3/comm ntb.armv7 File opened for reading /proc/785/comm ntb.armv7 File opened for reading /proc/18/comm ntb.armv7 File opened for reading /proc/24/comm ntb.armv7 File opened for reading /proc/32/comm ntb.armv7 File opened for reading /proc/45/comm ntb.armv7 File opened for reading /proc/194/comm ntb.armv7 File opened for reading /proc/self/stat ntb.armv7 File opened for reading /proc/30/comm ntb.armv7 File opened for reading /proc/74/comm ntb.armv7 File opened for reading /proc/625/comm ntb.armv7 File opened for reading /proc/19/comm ntb.armv7 File opened for reading /proc/26/comm ntb.armv7 File opened for reading /proc/46/comm ntb.armv7 File opened for reading /proc/58/comm ntb.armv7 File opened for reading /proc/352/comm ntb.armv7 File opened for reading /proc/358/comm ntb.armv7 File opened for reading /proc/732/comm ntb.armv7 File opened for reading /proc/779/comm ntb.armv7 File opened for reading /proc/29/comm ntb.armv7 File opened for reading /proc/789/comm ntb.armv7 File opened for reading /proc/295/comm ntb.armv7 File opened for reading /proc/9/comm ntb.armv7 File opened for reading /proc/21/comm ntb.armv7 File opened for reading /proc/33/comm ntb.armv7 File opened for reading /proc/144/comm ntb.armv7 File opened for reading /proc/359/comm ntb.armv7 File opened for reading /proc/365/comm ntb.armv7 File opened for reading /proc/376/comm ntb.armv7 File opened for reading /proc/self/status ntb.armv7 File opened for reading /proc/7/comm ntb.armv7 File opened for reading /proc/17/comm ntb.armv7 File opened for reading /proc/23/comm ntb.armv7 File opened for reading /proc/28/comm ntb.armv7 File opened for reading /proc/43/comm ntb.armv7 File opened for reading /proc/677/comm ntb.armv7 File opened for reading /proc/681/comm ntb.armv7 File opened for reading /proc/6/comm ntb.armv7 File opened for reading /proc/8/comm ntb.armv7 File opened for reading /proc/782/comm ntb.armv7 File opened for reading /proc/1/comm ntb.armv7 File opened for reading /proc/38/comm ntb.armv7 File opened for reading /proc/778/comm ntb.armv7 File opened for reading /proc/792/comm ntb.armv7 File opened for reading /proc/self/maps ntb.armv7 File opened for reading /proc/11/comm ntb.armv7 File opened for reading /proc/20/comm ntb.armv7 File opened for reading /proc/36/comm ntb.armv7 File opened for reading /proc/57/comm ntb.armv7 File opened for reading /proc/5/comm ntb.armv7 File opened for reading /proc/52/comm ntb.armv7 File opened for reading /proc/622/comm ntb.armv7 File opened for reading /proc/uptime ntb.armv7 File opened for reading /proc/13/comm ntb.armv7 File opened for reading /proc/16/comm ntb.armv7 File opened for reading /proc/27/comm ntb.armv7 File opened for reading /proc/283/comm ntb.armv7