Analysis
- max time kernel
141s - max time network
144s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
16/09/2026, 12:33
General
- Target manta.arm7.elf
- Size 132KB
- Sample260916-prbl1aah72
- SHA256 a18382fec04f3a91d97982946d12d099bbc4428231378beb3c26ad44e0e613cb
- MD5 ae410fef9007644dfef57a9d08bac99f
- SHA1 7d2cb8e32b7c03f4a26a8307cde25f96c7c4e6b2
- SHA512 4ac66fe3bde0c6e4919d6d33374a1df93d81ef93c9d6050f9d70f67bb84aef879db0f28c5b31aac320d2337fe39789404d33d3108dea9082876e3d526c3310b1
- SSDEEP 3072:sfqNLm7iN5qV4zt+suvY490U+/8kzIah4rEcP6MrsfpecA3RSoQSy:7Lm7ie8ttuvx90lbzIah4rEcCMrsBAh6
- TLSH T148D30A46A9419B12D4D722FAFAAE418933137FBCE3FA7102DD205F5023C599B0EB7612
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Traces itself 20 IoCs
Traces itself to prevent debugging attempts
pid Process 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf 783 manta.arm7.elf - Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself nginx 783 manta.arm7.elf Changes the process name, possibly in an attempt to hide itself mediacodec 783 manta.arm7.elf - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo manta.arm7.elf -
description ioc Process File opened for reading /proc/mounts manta.arm7.elf File opened for reading /proc/self/status manta.arm7.elf File opened for reading /proc/stat manta.arm7.elf