Analysis
- max time kernel
150s - max time network
150s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
01/09/2026, 15:59
Static task
static1
Behavioral task
behavioral1
Sample
armv5l.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target armv5l.elf
- Size 7.2MB
- Sample260901-te919awsav
- SHA256 2f43448fbf7a8a51e84f531dbd644ece019b4508da237200abd646fc27d18d40
- MD5 3d9b314ee31f37dab34773822f7114e0
- SHA1 f858fa100079a409006492a2b7842dcaedc88d21
- SHA512 6897e75b697202ba8b96a3c0e56fa9888de741d22ec0e97d44c52677557da7fdd7e11b0e56f15de3be45d93169830b587e781979ea4ce1ec8e69aaced9ca12e1
- SSDEEP 98304:UdVVgDl3pPW0TqlKc5GLZ4hLFs6zARE15:UCG0TqlKc504hLFs6j7
- TLSH T106761997B8924952C4E83A37BCBD80D433631EB99B87565A6D05FE383EBE1D90E34314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/lib/packagekit/packagekitd 822 armv5l.elf - Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size armv5l.elf File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max armv5l.elf -
description ioc Process File opened for reading /proc/198/stat armv5l.elf File opened for reading /proc/2/environ armv5l.elf File opened for reading /proc/10/environ armv5l.elf File opened for reading /proc/10/stat armv5l.elf File opened for reading /proc/57/environ armv5l.elf File opened for reading /proc/14/stat armv5l.elf File opened for reading /proc/15/environ armv5l.elf File opened for reading /proc/21/stat armv5l.elf File opened for reading /proc/27/stat armv5l.elf File opened for reading /proc/35/environ armv5l.elf File opened for reading /proc/11/stat armv5l.elf File opened for reading /proc/4/environ armv5l.elf File opened for reading /proc/45/environ armv5l.elf File opened for reading /proc/734/environ armv5l.elf File opened for reading /proc/795/environ armv5l.elf File opened for reading /proc/18/environ armv5l.elf File opened for reading /proc/23/environ armv5l.elf File opened for reading /proc/32/stat armv5l.elf File opened for reading /proc/33/environ armv5l.elf File opened for reading /proc/777/environ armv5l.elf File opened for reading /proc/9/stat armv5l.elf File opened for reading /proc/self/mountinfo armv5l.elf File opened for reading /proc/35/stat armv5l.elf File opened for reading /proc/46/stat armv5l.elf File opened for reading /proc/143/environ armv5l.elf File opened for reading /proc/44/stat armv5l.elf File opened for reading /proc/7/stat armv5l.elf File opened for reading /proc/11/environ armv5l.elf File opened for reading /proc/14/environ armv5l.elf File opened for reading /proc/22/environ armv5l.elf File opened for reading /proc/25/environ armv5l.elf File opened for reading /proc/29/environ armv5l.elf File opened for reading /proc/56/environ armv5l.elf File opened for reading /proc/796/environ armv5l.elf File opened for reading /proc/20/stat armv5l.elf File opened for reading /proc/34/stat armv5l.elf File opened for reading /proc/30/stat armv5l.elf File opened for reading /proc/36/environ armv5l.elf File opened for reading /proc/827/environ armv5l.elf File opened for reading /proc/849/environ armv5l.elf File opened for reading /proc/24/stat armv5l.elf File opened for reading /proc/28/stat armv5l.elf File opened for reading /proc/34/environ armv5l.elf File opened for reading /proc/51/environ armv5l.elf File opened for reading /proc/56/stat armv5l.elf File opened for reading /proc/31/stat armv5l.elf File opened for reading /proc/42/environ armv5l.elf File opened for reading /proc/5/stat armv5l.elf File opened for reading /proc/8/stat armv5l.elf File opened for reading /proc/219/environ armv5l.elf File opened for reading /proc/23/stat armv5l.elf File opened for reading /proc/26/stat armv5l.elf File opened for reading /proc/28/environ armv5l.elf File opened for reading /proc/3/environ armv5l.elf File opened for reading /proc/5/environ armv5l.elf File opened for reading /proc/795/stat armv5l.elf File opened for reading /proc/17/stat armv5l.elf File opened for reading /proc/21/environ armv5l.elf File opened for reading /proc/27/environ armv5l.elf File opened for reading /proc/30/environ armv5l.elf File opened for reading /proc/44/environ armv5l.elf File opened for reading /proc/850/stat armv5l.elf File opened for reading /proc/self/cgroup armv5l.elf File opened for reading /proc/142/stat armv5l.elf