Analysis
- max time kernel
149s - max time network
149s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
02/09/2026, 05:55
Static task
static1
Behavioral task
behavioral1
Sample
iran.armv7l.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target iran.armv7l.elf
- Size 142KB
- Sample260902-gmrtesyvbw
- SHA256 de83746bf75a7dbdad061ec4b82e9c403eec44b1441cc4b207ddbe21cd787575
- MD5 2a3041cd112ae134d16b308afd2a76d7
- SHA1 d5a345d11740a995590165362938e7366e56f20e
- SHA512 0fadc3e59ed6fb8976e5cddb75f3e35e3bdcb5c8e1a9b618226fad4e715c71b263d2e0e5acf2dca83e264fd20c074b0fbe4aedab781097df2135403b3bbe1641
- SSDEEP 3072:hDZLTmkCyUkB8ML7TE4mj/IZPOfrgQjwMJapvoMnkg80rfOkWqme6MaipJ8ipi:hDZLTmk9UkB8M7tmjwgzg6/JapHnkg8W
- TLSH T126E3F749ED42AF00D5D636FAFE4E428973935B6CE3FE71129E245B2127CA91B0F7A101
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/xs.main iran.armv7l.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself -sh 792 iran.armv7l.elf -
description ioc Process File opened for reading /proc/10/cmdline iran.armv7l.elf File opened for reading /proc/34/status iran.armv7l.elf File opened for reading /proc/45/stat iran.armv7l.elf File opened for reading /proc/56/stat iran.armv7l.elf File opened for reading /proc/143/status iran.armv7l.elf File opened for reading /proc/783/stat iran.armv7l.elf File opened for reading /proc/786/stat iran.armv7l.elf File opened for reading /proc/790/comm iran.armv7l.elf File opened for reading /proc/4/status iran.armv7l.elf File opened for reading /proc/10/status iran.armv7l.elf File opened for reading /proc/142/cmdline iran.armv7l.elf File opened for reading /proc/342/stat iran.armv7l.elf File opened for reading /proc/623/cmdline iran.armv7l.elf File opened for reading /proc/766/stat iran.armv7l.elf File opened for reading /proc/785/exe iran.armv7l.elf File opened for reading /proc/6/comm iran.armv7l.elf File opened for reading /proc/17/comm iran.armv7l.elf File opened for reading /proc/34/cmdline iran.armv7l.elf File opened for reading /proc/198/stat iran.armv7l.elf File opened for reading /proc/785/cmdline iran.armv7l.elf File opened for reading /proc/798/cmdline iran.armv7l.elf File opened for reading /proc/810/status iran.armv7l.elf File opened for reading /proc/8/status iran.armv7l.elf File opened for reading /proc/32/stat iran.armv7l.elf File opened for reading /proc/789/stat iran.armv7l.elf File opened for reading /proc/789/cmdline iran.armv7l.elf File opened for reading /proc/811/cmdline iran.armv7l.elf File opened for reading /proc/22/cmdline iran.armv7l.elf File opened for reading /proc/17/cmdline iran.armv7l.elf File opened for reading /proc/73/status iran.armv7l.elf File opened for reading /proc/35/comm iran.armv7l.elf File opened for reading /proc/198/comm iran.armv7l.elf File opened for reading /proc/45/comm iran.armv7l.elf File opened for reading /proc/30/cmdline iran.armv7l.elf File opened for reading /proc/735/stat iran.armv7l.elf File opened for reading /proc/7/status iran.armv7l.elf File opened for reading /proc/4/comm iran.armv7l.elf File opened for reading /proc/33/comm iran.armv7l.elf File opened for reading /proc/675/comm iran.armv7l.elf File opened for reading /proc/786/comm iran.armv7l.elf File opened for reading /proc/789/comm iran.armv7l.elf File opened for reading /proc/13/cmdline iran.armv7l.elf File opened for reading /proc/15/stat iran.armv7l.elf File opened for reading /proc/26/stat iran.armv7l.elf File opened for reading /proc/36/status iran.armv7l.elf File opened for reading /proc/51/status iran.armv7l.elf File opened for reading /proc/56/task/56/children iran.armv7l.elf File opened for reading /proc/5/stat iran.armv7l.elf File opened for reading /proc/6/cmdline iran.armv7l.elf File opened for reading /proc/7/stat iran.armv7l.elf File opened for reading /proc/29/comm iran.armv7l.elf File opened for reading /proc/198/status iran.armv7l.elf File opened for reading /proc/219/comm iran.armv7l.elf File opened for reading /proc/645/cmdline iran.armv7l.elf File opened for reading /proc/783/status iran.armv7l.elf File opened for reading /proc/785/stat iran.armv7l.elf File opened for reading /proc/338/comm iran.armv7l.elf File opened for reading /proc/3/status iran.armv7l.elf File opened for reading /proc/19/stat iran.armv7l.elf File opened for reading /proc/23/status iran.armv7l.elf File opened for reading /proc/22/stat iran.armv7l.elf File opened for reading /proc/23/comm iran.armv7l.elf File opened for reading /proc/25/comm iran.armv7l.elf File opened for reading /proc/31/comm iran.armv7l.elf
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/init.d/xs.main
- Size 32B
- SHA256 07a3da163d4b263854795e963f868077a4e049307750bb96d47f5e01d4343ff5
- MD5 b242b0051a2e3503916ba15722f5f19f
- SHA1 12d815de596c80b9ade3aafb8f41896dfa77b006
- SHA512 cc1fd37c4706c0559d046164e7a5036f6862683d954a74169a235dca3149bd1f07858e24fbd9271055837901b835a7e611575c4ae86542cb1521f986e2007c02
- MD5 SHA1 SHA512