Analysis
- max time kernel
149s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
12/09/2026, 04:33
Behavioral task
behavioral1
Sample
libyahu.so.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target libyahu.so.elf
- Size 338KB
- Sample260912-e6m88saq8x
- SHA256 5002282edb86e86fd7d7eedd8b3bd2444390eec0d18e93641d23c89cdba1f9ef
- MD5 835980375873b6af6ceacb7af05cfbe3
- SHA1 9ccb733b6fa448a42b86eb13fd088f77beba1bdd
- SHA512 dfd4bb6d4acc3aa4a0c608a988607939482276669b56d10c257a07e52c3cf39d5e3f1ac979719be1aee828a884700084e303ff6353e231b08fc768c6f651b7df
- SSDEEP 6144:qT/k5Qg5p7dJol2qIB9/Wy3cmw3ntxrRhklTLTvb8Pi7j9Jj6OP:E/O/Li/APw3r9he7FJjd
- TLSH T1417409A6FC42D981C5D429FAFB1EC2C833031378E3DA7112AD168B25A5CF55D4E3EA91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/botnets 786 libyahu.so.elf -
description ioc Process File opened for reading /proc/315/stat libyahu.so.elf File opened for reading /proc/369/comm libyahu.so.elf File opened for reading /proc/790/stat libyahu.so.elf File opened for reading /proc/806/stat libyahu.so.elf File opened for reading /proc/809/cmdline libyahu.so.elf File opened for reading /proc/337/cmdline libyahu.so.elf File opened for reading /proc/622/cmdline libyahu.so.elf File opened for reading /proc/682/stat libyahu.so.elf File opened for reading /proc/788/stat libyahu.so.elf File opened for reading /proc/791/stat libyahu.so.elf File opened for reading /proc/799/cmdline libyahu.so.elf File opened for reading /proc/193/comm libyahu.so.elf File opened for reading /proc/198/stat libyahu.so.elf File opened for reading /proc/315/comm libyahu.so.elf File opened for reading /proc/643/stat libyahu.so.elf File opened for reading /proc/764/cmdline libyahu.so.elf File opened for reading /proc/784/comm libyahu.so.elf File opened for reading /proc/800/cmdline libyahu.so.elf File opened for reading /proc/643/cmdline libyahu.so.elf File opened for reading /proc/677/stat libyahu.so.elf File opened for reading /proc/142/stat libyahu.so.elf File opened for reading /proc/142/cmdline libyahu.so.elf File opened for reading /proc/193/stat libyahu.so.elf File opened for reading /proc/200/comm libyahu.so.elf File opened for reading /proc/218/comm libyahu.so.elf File opened for reading /proc/352/stat libyahu.so.elf File opened for reading /proc/316/comm libyahu.so.elf File opened for reading /proc/316/cmdline libyahu.so.elf File opened for reading /proc/317/cmdline libyahu.so.elf File opened for reading /proc/337/comm libyahu.so.elf File opened for reading /proc/341/comm libyahu.so.elf File opened for reading /proc/734/cmdline libyahu.so.elf File opened for reading /proc/778/comm libyahu.so.elf File opened for reading /proc/779/stat libyahu.so.elf File opened for reading /proc/356/comm libyahu.so.elf File opened for reading /proc/728/stat libyahu.so.elf File opened for reading /proc/779/cmdline libyahu.so.elf File opened for reading /proc/793/comm libyahu.so.elf File opened for reading /proc/143/stat libyahu.so.elf File opened for reading /proc/337/stat libyahu.so.elf File opened for reading /proc/728/comm libyahu.so.elf File opened for reading /proc/764/comm libyahu.so.elf File opened for reading /proc/778/stat libyahu.so.elf File opened for reading /proc/779/comm libyahu.so.elf File opened for reading /proc/784/cmdline libyahu.so.elf File opened for reading /proc/791/comm libyahu.so.elf File opened for reading /proc/218/stat libyahu.so.elf File opened for reading /proc/330/comm libyahu.so.elf File opened for reading /proc/642/comm libyahu.so.elf File opened for reading /proc/734/comm libyahu.so.elf File opened for reading /proc/784/stat libyahu.so.elf File opened for reading /proc/791/cmdline libyahu.so.elf File opened for reading /proc/792/cmdline libyahu.so.elf File opened for reading /proc/793/stat libyahu.so.elf File opened for reading /proc/255/comm libyahu.so.elf File opened for reading /proc/317/stat libyahu.so.elf File opened for reading /proc/317/comm libyahu.so.elf File opened for reading /proc/352/comm libyahu.so.elf File opened for reading /proc/790/cmdline libyahu.so.elf File opened for reading /proc/800/stat libyahu.so.elf File opened for reading /proc/809/comm libyahu.so.elf File opened for reading /proc/142/comm libyahu.so.elf File opened for reading /proc/193/cmdline libyahu.so.elf File opened for reading /proc/341/stat libyahu.so.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.hwid_id libyahu.so.elf
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.hwid_id
- Size 33B
- SHA256 a9e814fc2d5a83c4d5b1c2312fe0cd00df0c47badc36175961c9b3cfe2b1daf5
- MD5 9869ee9abe0acbb7db421c7a76a2bc33
- SHA1 1db06e080c3677dd326e59dacf8e7d744a065c68
- SHA512 094344d3800627fa5dcd8125fffafd21a63a055f9151a7148d1c6b049f398296bd59ccc3e65b03ae74cbc57fbad5ba218995b845271b76e4c8a66933b5e415ae
- MD5 SHA1 SHA512