Analysis
- max time kernel
4s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
25/08/2026, 18:14
Static task
static1
Behavioral task
behavioral1
Sample
giget
Resource
ubuntu1804-amd64-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
giget
Resource
debian9-armhf-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
giget
Resource
debian9-mipsbe-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
giget
Resource
debian9-mipsel-20260513-en
0 signatures
150 seconds
General
- Target giget
- Size 2KB
- Sample260825-wvg2hsac98
- SHA256 5cb8db51be78dcca60094120ee22fe92d0859650d4f23e8b75daca3bc432e7a2
- MD5 34af03c175befcf7132727068cb9404d
- SHA1 7139c3879b9e7388078c86e0959dbdec4b02e957
- SHA512 c716b4eaad2ac988f2b8a1d5d994567b2321ed75be1bba8ec9a1ead68b28a60a0240ec483338fea961775741bfe94d139113f4da2d95f4f30e92ff2b19368d33
- TLSH T18951840EC35CB1622FDE011D9E2CB5C5493D8393ABA150FB8E9E5604306C6A2877A3E7
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo node - Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online node - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/memory/memory.limit_in_bytes node -
description ioc Process File opened for reading /proc/meminfo node
Processes
-
/tmp/giget/tmp/giget1⤵PID:654
-
/usr/local/sbin/nodenode /tmp/giget1⤵PID:654
-
/usr/local/bin/nodenode /tmp/giget1⤵PID:654
-
/usr/sbin/nodenode /tmp/giget1⤵PID:654
-
/usr/bin/nodenode /tmp/giget1⤵
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:654