Analysis
- max time kernel
149s - max time network
142s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
16/09/2026, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
armv7l.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
7 signatures
150 seconds
General
- Target armv7l.elf
- Size 710KB
- Sample260916-2sd5qsfc32
- SHA256 b5bf48e6b6d3348a126a454dff4f7f321c0d2a3d045f3a2902096a41e3ff37a6
- MD5 0dc8f879259c911229c62d01c277c434
- SHA1 91859713349b6584cfc0824c5beb3271f5ccf780
- SHA512 13cedc7cbf413c3fc60b63ec3d14b1bcac3383b0a88d6430ef76aceaa47ddfa4cc8118bd026d5845f9198c4b2e9749388aa0f8ad598a77032207f6e12dd33c98
- SSDEEP 12288:UrSzhpHAPrDfa0ylva86o2pSRLGJdHjKMN0udx517o/KNr1p3OKRb:8mYz+0o4o2NjJn59oS5TeKR
- TLSH T155F45A95F850CF52CAC65A3AF7AE52483323537EC3DAB20E59185738369787B4F3A244
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 3 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/class/dmi/id/product_name armv7l.elf File opened for reading /sys/class/dmi/id/sys_vendor armv7l.elf File opened for reading /sys/class/dmi/id/board_vendor armv7l.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads MAC address of network interface 2 TTPs 1 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
description ioc Process File opened for reading /sys/class/net/eth0/address armv7l.elf - Reads network interface configuration 2 TTPs 2 IoCs
Fetches information about one or more active network interfaces.
description ioc Process File opened for reading /sys/class/net/eth0/flags armv7l.elf File opened for reading /sys/class/net/eth0/carrier armv7l.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself ntpclient 792 armv7l.elf - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/class/net armv7l.elf -
description ioc Process File opened for reading /proc/243/cmdline armv7l.elf File opened for reading /proc/372/cmdline armv7l.elf File opened for reading /proc/793/cmdline armv7l.elf File opened for reading /proc/624/status armv7l.elf File opened for reading /proc/5/cmdline armv7l.elf File opened for reading /proc/733/status armv7l.elf File opened for reading /proc/800/status armv7l.elf File opened for reading /proc/20/cmdline armv7l.elf File opened for reading /proc/143/cmdline armv7l.elf File opened for reading /proc/359/cmdline armv7l.elf File opened for reading /proc/5/status armv7l.elf File opened for reading /proc/641/status armv7l.elf File opened for reading /proc/642/status armv7l.elf File opened for reading /proc/683/fd armv7l.elf File opened for reading /proc/789/cmdline armv7l.elf File opened for reading /proc/803/fd armv7l.elf File opened for reading /proc/19/cmdline armv7l.elf File opened for reading /proc/24/cmdline armv7l.elf File opened for reading /proc/315/cmdline armv7l.elf File opened for reading /proc/792/cmdline armv7l.elf File opened for reading /proc/4/status armv7l.elf File opened for reading /proc/15/status armv7l.elf File opened for reading /proc/23/status armv7l.elf File opened for reading /proc/30/status armv7l.elf File opened for reading /proc/13/cmdline armv7l.elf File opened for reading /proc/31/cmdline armv7l.elf File opened for reading /proc/220/cmdline armv7l.elf File opened for reading /proc/31/status armv7l.elf File opened for reading /proc/220/fd armv7l.elf File opened for reading /proc/334/fd armv7l.elf File opened for reading /proc/354/fd armv7l.elf File opened for reading /proc/22/cmdline armv7l.elf File opened for reading /proc/733/cmdline armv7l.elf File opened for reading /proc/790/cmdline armv7l.elf File opened for reading /proc/800/cmdline armv7l.elf File opened for reading /proc/18/status armv7l.elf File opened for reading /proc/28/status armv7l.elf File opened for reading /proc/35/status armv7l.elf File opened for reading /proc/36/status armv7l.elf File opened for reading /proc/44/cmdline armv7l.elf File opened for reading /proc/57/status armv7l.elf File opened for reading /proc/204/status armv7l.elf File opened for reading /proc/340/status armv7l.elf File opened for reading /proc/785/status armv7l.elf File opened for reading /proc/785/fd armv7l.elf File opened for reading /proc/792/status armv7l.elf File opened for reading /proc/811/cmdline armv7l.elf File opened for reading /proc/10/cmdline armv7l.elf File opened for reading /proc/318/cmdline armv7l.elf File opened for reading /proc/1/fd armv7l.elf File opened for reading /proc/9/status armv7l.elf File opened for reading /proc/803/cmdline armv7l.elf File opened for reading /proc/203/status armv7l.elf File opened for reading /proc/788/status armv7l.elf File opened for reading /proc/35/cmdline armv7l.elf File opened for reading /proc/317/cmdline armv7l.elf File opened for reading /proc/32/status armv7l.elf File opened for reading /proc/44/status armv7l.elf File opened for reading /proc/813/fd armv7l.elf File opened for reading /proc/204/cmdline armv7l.elf File opened for reading /proc/624/cmdline armv7l.elf File opened for reading /proc/739/cmdline armv7l.elf File opened for reading /proc/220/status armv7l.elf File opened for reading /proc/318/status armv7l.elf