Analysis
- max time kernel
147s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
25/08/2026, 14:37
Static task
static1
Behavioral task
behavioral1
Sample
AGbot.armv6l.elf
Resource
debian12-armhf-20260127-en
debian-12-armhf
3 signatures
150 seconds
General
- Target AGbot.armv6l.elf
- Size 10KB
- Sample260825-rza2jstdnf
- SHA256 5f5409ab02f05934b010edefe9c00af9aac1ca20ff270546e1b99958394cb79e
- MD5 84232c6c70498d81ae3fda700e84b8bf
- SHA1 4c3ab76ad0f9117d8548d7370220bc96d43f32a0
- SHA512 60bb6a288675cb5843956309d03476eff3b67d2d66b32d437769f3e0db83e0e3dda5bfb45ce320c6c6549038714dd26b2ced7b34481a7f4d2fa5fd72a3ca71b0
- SSDEEP 192:bqUYzzoUeVRQYHJqcshCfN0g5a9Yibn9xIv3GGRgt3OWtByuZqQ:rIReVR9vNdFYn72gt38u
- TLSH T1B222B618F8919926DEA43979FE7D159C3792C3F8E2FA7112CD08863637952014F2BD27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 785 AGbot.armv6l.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 785 AGbot.armv6l.elf -
description ioc Process File opened for reading /proc/45cmdline AGbot.armv6l.elf File opened for reading /proc/370cmdline AGbot.armv6l.elf File opened for reading /proc/1025cmdline AGbot.armv6l.elf File opened for reading /proc/2623cmdline AGbot.armv6l.elf File opened for reading /proc/2710cmdline AGbot.armv6l.elf File opened for reading /proc/2736cmdline AGbot.armv6l.elf File opened for reading /proc/5004cmdline AGbot.armv6l.elf File opened for reading /proc/6328cmdline AGbot.armv6l.elf File opened for reading /proc/4484cmdline AGbot.armv6l.elf File opened for reading /proc/6450cmdline AGbot.armv6l.elf File opened for reading /proc/7153cmdline AGbot.armv6l.elf File opened for reading /proc/7221cmdline AGbot.armv6l.elf File opened for reading /proc/2879cmdline AGbot.armv6l.elf File opened for reading /proc/3325cmdline AGbot.armv6l.elf File opened for reading /proc/3617cmdline AGbot.armv6l.elf File opened for reading /proc/6068cmdline AGbot.armv6l.elf File opened for reading /proc/2098cmdline AGbot.armv6l.elf File opened for reading /proc/4326cmdline AGbot.armv6l.elf File opened for reading /proc/5386cmdline AGbot.armv6l.elf File opened for reading /proc/6182cmdline AGbot.armv6l.elf File opened for reading /proc/230cmdline AGbot.armv6l.elf File opened for reading /proc/1190cmdline AGbot.armv6l.elf File opened for reading /proc/5186cmdline AGbot.armv6l.elf File opened for reading /proc/5270cmdline AGbot.armv6l.elf File opened for reading /proc/5354cmdline AGbot.armv6l.elf File opened for reading /proc/5455cmdline AGbot.armv6l.elf File opened for reading /proc/1252cmdline AGbot.armv6l.elf File opened for reading /proc/3806cmdline AGbot.armv6l.elf File opened for reading /proc/4157cmdline AGbot.armv6l.elf File opened for reading /proc/4274cmdline AGbot.armv6l.elf File opened for reading /proc/6491cmdline AGbot.armv6l.elf File opened for reading /proc/7033cmdline AGbot.armv6l.elf File opened for reading /proc/7338cmdline AGbot.armv6l.elf File opened for reading /proc/7930cmdline AGbot.armv6l.elf File opened for reading /proc/2080cmdline AGbot.armv6l.elf File opened for reading /proc/2960cmdline AGbot.armv6l.elf File opened for reading /proc/3044cmdline AGbot.armv6l.elf File opened for reading /proc/5755cmdline AGbot.armv6l.elf File opened for reading /proc/6191cmdline AGbot.armv6l.elf File opened for reading /proc/250cmdline AGbot.armv6l.elf File opened for reading /proc/2488cmdline AGbot.armv6l.elf File opened for reading /proc/2640cmdline AGbot.armv6l.elf File opened for reading /proc/3604cmdline AGbot.armv6l.elf File opened for reading /proc/4513cmdline AGbot.armv6l.elf File opened for reading /proc/5218cmdline AGbot.armv6l.elf File opened for reading /proc/3679cmdline AGbot.armv6l.elf File opened for reading /proc/6006cmdline AGbot.armv6l.elf File opened for reading /proc/192cmdline AGbot.armv6l.elf File opened for reading /proc/2021cmdline AGbot.armv6l.elf File opened for reading /proc/4033cmdline AGbot.armv6l.elf File opened for reading /proc/5327cmdline AGbot.armv6l.elf File opened for reading /proc/6609cmdline AGbot.armv6l.elf File opened for reading /proc/234cmdline AGbot.armv6l.elf File opened for reading /proc/1934cmdline AGbot.armv6l.elf File opened for reading /proc/3543cmdline AGbot.armv6l.elf File opened for reading /proc/5250cmdline AGbot.armv6l.elf File opened for reading /proc/6933cmdline AGbot.armv6l.elf File opened for reading /proc/2864cmdline AGbot.armv6l.elf File opened for reading /proc/3060cmdline AGbot.armv6l.elf File opened for reading /proc/7508cmdline AGbot.armv6l.elf File opened for reading /proc/1068cmdline AGbot.armv6l.elf File opened for reading /proc/1906cmdline AGbot.armv6l.elf File opened for reading /proc/3290cmdline AGbot.armv6l.elf File opened for reading /proc/11cmdline AGbot.armv6l.elf