Analysis
- max time kernel
148s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
25/08/2026, 18:20
Static task
static1
Behavioral task
behavioral1
Sample
armv6l
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target armv6l
- Size 7.1MB
- Sample260825-wy9wpstygs
- SHA256 7b1985fd9824ec0813a2fa8a47cf7a9ef29f8001407aace06952a118011a29b0
- MD5 d885dcf703d207f2aab221ca26878807
- SHA1 be1155aa569fc9c025ccb2cae10a06bfe4f0f6af
- SHA512 68ff1b334869e5ce25494559d8568ee2c319b1c96993d87562edb3a30a30bafe4bbbc7461b5def4215e4acf1b2cc1e7e9364b26046b02de00088c3d1998f8fa7
- SSDEEP 49152:sYF1ptS7MViYPa5XwlVVMGvYdM0mMiA7co3UE5cO78g0UBD5Eu:FTeL60XwlVVMGvYncO78xUfEu
- TLSH T1D5762A97B8924952C4E43A77B8BE81C433630EB98BC7565B6D04EE383EBE1D90E35744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/lib/boltd/boltd 791 armv6l - Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size armv6l File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max armv6l -
description ioc Process File opened for reading /proc/23/environ armv6l File opened for reading /proc/24/environ armv6l File opened for reading /proc/4/stat armv6l File opened for reading /proc/56/stat armv6l File opened for reading /proc/765/environ armv6l File opened for reading /proc/13/environ armv6l File opened for reading /proc/143/environ armv6l File opened for reading /proc/3/stat armv6l File opened for reading /proc/31/stat armv6l File opened for reading /proc/34/environ armv6l File opened for reading /proc/7/stat armv6l File opened for reading /proc/798/stat armv6l File opened for reading /proc/self/mountinfo armv6l File opened for reading /proc/22/environ armv6l File opened for reading /proc/44/environ armv6l File opened for reading /proc/46/environ armv6l File opened for reading /proc/51/stat armv6l File opened for reading /proc/788/environ armv6l File opened for reading /proc/9/environ armv6l File opened for reading /proc/30/environ armv6l File opened for reading /proc/12/stat armv6l File opened for reading /proc/142/environ armv6l File opened for reading /proc/32/stat armv6l File opened for reading /proc/36/environ armv6l File opened for reading /proc/4/environ armv6l File opened for reading /proc/624/environ armv6l File opened for reading /proc/self/auxv armv6l File opened for reading /proc/12/environ armv6l File opened for reading /proc/14/environ armv6l File opened for reading /proc/14/stat armv6l File opened for reading /proc/198/stat armv6l File opened for reading /proc/2/stat armv6l File opened for reading /proc/3/environ armv6l File opened for reading /proc/34/stat armv6l File opened for reading /proc/11/stat armv6l File opened for reading /proc/23/stat armv6l File opened for reading /proc/28/environ armv6l File opened for reading /proc/33/stat armv6l File opened for reading /proc/35/environ armv6l File opened for reading /proc/45/environ armv6l File opened for reading /proc/56/environ armv6l File opened for reading /proc/73/stat armv6l File opened for reading /proc/16/environ armv6l File opened for reading /proc/19/environ armv6l File opened for reading /proc/19/stat armv6l File opened for reading /proc/31/environ armv6l File opened for reading /proc/36/stat armv6l File opened for reading /proc/42/environ armv6l File opened for reading /proc/5/stat armv6l File opened for reading /proc/765/stat armv6l File opened for reading /proc/self/cgroup armv6l File opened for reading /proc/15/environ armv6l File opened for reading /proc/2/environ armv6l File opened for reading /proc/779/environ armv6l File opened for reading /proc/781/environ armv6l File opened for reading /proc/8/stat armv6l File opened for reading /proc/9/stat armv6l File opened for reading /proc/10/environ armv6l File opened for reading /proc/16/stat armv6l File opened for reading /proc/18/environ armv6l File opened for reading /proc/25/stat armv6l File opened for reading /proc/35/stat armv6l File opened for reading /proc/624/stat armv6l File opened for reading /proc/20/environ armv6l