Analysis
- max time kernel
148s - max time network
153s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
25/08/2026, 18:20
Static task
static1
Behavioral task
behavioral1
Sample
armv5l
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target armv5l
- Size 7.1MB
- Sample260825-wy9wpstyf1
- SHA256 e1fe2086329da141df89da4056c556eb5ccb1d7aeff9ca1475477bef0d389408
- MD5 b1cae12e66deabe5e9d9056bfa6e2071
- SHA1 605530c6b26dfe19beef044bc9442f8db007778c
- SHA512 fbf8c30d5b483c54ac74a1184632e9da78fa80a29b20b89143e8ac0602b98057f66c6705f896ec646afdfe7bf6ed70600a1b1267e171a5eb27c6ab7855d888d9
- SSDEEP 49152:8o5Pg2CESL6qNkXnsLd9/jLk50M70+qRtm9HqSyP4GFsbm5zvuLA5El:l8L6qN0ned9/jLk50d4GFsKEyEl
- TLSH T1F7763A87B8924952C4E43A37BCBE81C432630EB99BC7565B6D15EE383EBE0D90E35744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/sbin/NetworkManager 790 armv5l - Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size armv5l File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max armv5l -
description ioc Process File opened for reading /proc/732/stat armv5l File opened for reading /proc/765/environ armv5l File opened for reading /proc/30/environ armv5l File opened for reading /proc/42/stat armv5l File opened for reading /proc/46/environ armv5l File opened for reading /proc/46/stat armv5l File opened for reading /proc/142/environ armv5l File opened for reading /proc/2/stat armv5l File opened for reading /proc/29/environ armv5l File opened for reading /proc/45/stat armv5l File opened for reading /proc/57/environ armv5l File opened for reading /proc/6/environ armv5l File opened for reading /proc/780/environ armv5l File opened for reading /proc/8/environ armv5l File opened for reading /proc/self/cgroup armv5l File opened for reading /proc/26/environ armv5l File opened for reading /proc/73/stat armv5l File opened for reading /proc/732/environ armv5l File opened for reading /proc/self/mountinfo armv5l File opened for reading /proc/15/stat armv5l File opened for reading /proc/201/stat armv5l File opened for reading /proc/21/environ armv5l File opened for reading /proc/3/environ armv5l File opened for reading /proc/5/stat armv5l File opened for reading /proc/14/environ armv5l File opened for reading /proc/13/stat armv5l File opened for reading /proc/18/stat armv5l File opened for reading /proc/20/environ armv5l File opened for reading /proc/28/environ armv5l File opened for reading /proc/29/stat armv5l File opened for reading /proc/34/environ armv5l File opened for reading /proc/6/stat armv5l File opened for reading /proc/143/environ armv5l File opened for reading /proc/143/stat armv5l File opened for reading /proc/198/stat armv5l File opened for reading /proc/22/stat armv5l File opened for reading /proc/24/stat armv5l File opened for reading /proc/779/environ armv5l File opened for reading /proc/779/stat armv5l File opened for reading /proc/797/environ armv5l File opened for reading /proc/10/stat armv5l File opened for reading /proc/12/environ armv5l File opened for reading /proc/198/environ armv5l File opened for reading /proc/3/stat armv5l File opened for reading /proc/33/stat armv5l File opened for reading /proc/35/stat armv5l File opened for reading /proc/5/environ armv5l File opened for reading /proc/788/stat armv5l File opened for reading /proc/11/stat armv5l File opened for reading /proc/18/environ armv5l File opened for reading /proc/25/stat armv5l File opened for reading /proc/28/stat armv5l File opened for reading /proc/32/environ armv5l File opened for reading /proc/36/stat armv5l File opened for reading /proc/797/stat armv5l File opened for reading /proc/9/stat armv5l File opened for reading /proc/self/auxv armv5l File opened for reading /proc/12/stat armv5l File opened for reading /proc/13/environ armv5l File opened for reading /proc/142/stat armv5l File opened for reading /proc/21/stat armv5l File opened for reading /proc/22/environ armv5l File opened for reading /proc/34/stat armv5l File opened for reading /proc/36/environ armv5l