Analysis
- max time kernel
149s - max time network
153s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
08/09/2026, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
iran.armv7l
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target iran.armv7l
- Size 142KB
- Sample260908-pl9lvabl3w
- SHA256 699848a33a1808fe612ce4e2e1f1bb292546509b3939c56b6842e315ad02d731
- MD5 c16b9c0f10125b96a0236f1f0dcc6dc8
- SHA1 63d3f3556148769f9a5b8f4419e5d425003ff9ac
- SHA512 c6aabd9f60a417d1120cdb0158c4f9af74ce6f67c2c224ceb526d58c42b145f4339cdab76b55cdadebff6079d91a4bd5dd1159c25b0a51d5c363aed559676f89
- SSDEEP 3072:6nZpD+/4jw0P4GmyvC/frevbzQpgMCa5bo0nIQc0r9vI2mmCULXJWciq0:6nZpD+/4jw0PpfvCazzQvCalfnIQc0rM
- TLSH T1B0E30749ED42AB00D5D636FAFE4E428973535B6CE3FE71129E245B2127CA92B0F7B101
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/xs.main iran.armv7l - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself -sh 784 iran.armv7l -
description ioc Process File opened for reading /proc/731/comm iran.armv7l File opened for reading /proc/10/status iran.armv7l File opened for reading /proc/15/status iran.armv7l File opened for reading /proc/29/stat iran.armv7l File opened for reading /proc/143/status iran.armv7l File opened for reading /proc/810/cmdline iran.armv7l File opened for reading /proc/2/status iran.armv7l File opened for reading /proc/314/cmdline iran.armv7l File opened for reading /proc/24/status iran.armv7l File opened for reading /proc/731/status iran.armv7l File opened for reading /proc/778/status iran.armv7l File opened for reading /proc/32/status iran.armv7l File opened for reading /proc/337/cmdline iran.armv7l File opened for reading /proc/15/stat iran.armv7l File opened for reading /proc/198/status iran.armv7l File opened for reading /proc/6/status iran.armv7l File opened for reading /proc/18/cmdline iran.armv7l File opened for reading /proc/25/cmdline iran.armv7l File opened for reading /proc/35/stat iran.armv7l File opened for reading /proc/7/comm iran.armv7l File opened for reading /proc/8/cmdline iran.armv7l File opened for reading /proc/25/status iran.armv7l File opened for reading /proc/26/status iran.armv7l File opened for reading /proc/51/status iran.armv7l File opened for reading /proc/51/cmdline iran.armv7l File opened for reading /proc/246/cmdline iran.armv7l File opened for reading /proc/734/cmdline iran.armv7l File opened for reading /proc/786/stat iran.armv7l File opened for reading /proc/731/cmdline iran.armv7l File opened for reading /proc/807/stat iran.armv7l File opened for reading /proc/5/stat iran.armv7l File opened for reading /proc/10/stat iran.armv7l File opened for reading /proc/17/stat iran.armv7l File opened for reading /proc/31/cmdline iran.armv7l File opened for reading /proc/803/comm iran.armv7l File opened for reading /proc/27/stat iran.armv7l File opened for reading /proc/731/exe iran.armv7l File opened for reading /proc/218/comm iran.armv7l File opened for reading /proc/622/comm iran.armv7l File opened for reading /proc/19/stat iran.armv7l File opened for reading /proc/28/status iran.armv7l File opened for reading /proc/791/stat iran.armv7l File opened for reading /proc/22/stat iran.armv7l File opened for reading /proc/44/status iran.armv7l File opened for reading /proc/198/cmdline iran.armv7l File opened for reading /proc/791/comm iran.armv7l File opened for reading /proc/2/stat iran.armv7l File opened for reading /proc/16/cmdline iran.armv7l File opened for reading /proc/29/cmdline iran.armv7l File opened for reading /proc/33/stat iran.armv7l File opened for reading /proc/810/status iran.armv7l File opened for reading /proc/27/comm iran.armv7l File opened for reading /proc/31/comm iran.armv7l File opened for reading /proc/313/comm iran.armv7l File opened for reading /proc/337/comm iran.armv7l File opened for reading /proc/21/status iran.armv7l File opened for reading /proc/734/status iran.armv7l File opened for reading /proc/13/comm iran.armv7l File opened for reading /proc/24/comm iran.armv7l File opened for reading /proc/772/comm iran.armv7l File opened for reading /proc/26/stat iran.armv7l File opened for reading /proc/734/stat iran.armv7l File opened for reading /proc/353/comm iran.armv7l File opened for reading /proc/3/stat iran.armv7l
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/init.d/xs.main
- Size 28B
- SHA256 5b0ccb787e4294422900cbf0da6ed5959672076d370df967b7cf1f5130755160
- MD5 e01d78c244ac547a3c2b2d9b4cd59d72
- SHA1 f70adf758a1a6afbbfbf8dd6ea2407651ee23e90
- SHA512 5b828a245bbb51159251c619985840be3e3b2fa3c3ff2ce8b29661075db9c9c7dea4f2cf8218b3c83ad6e8ea8c06c2f49e227690d7bb497bee0ce95a511182de
- MD5 SHA1 SHA512