Analysis
- max time kernel
146s - max time network
149s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
16/09/2026, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
3 signatures
150 seconds
General
- Target a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf
- Size 4.8MB
- Sample260916-rlwq4aws2n
- SHA256 a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f
- MD5 a32bd39b4b1b02c52407f4f093cd48d3
- SHA1 58da3d4a7e0dc42ecb9dc3428cc694fe29456292
- SHA512 df7f608fa67673bbf0b9076b0b55c85558db043321cd69e20627fbb65be3ac7fb5f3054ecde18965e5520ffd79ada38d860ce5b9281ca07ce010b7390cabeb88
- SSDEEP 49152:AB6qeUY2CzY/Dj9MzH6BN6HyWkwATj914:8reOC8Dj9MzHGN6HZv
- TLSH T148361A87B8824A43C4E83676B87D81C873A74EB99B9713566D04FE3C3BBE1990E35714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf -
description ioc Process File opened for reading /proc/32/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/367/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/805/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/25/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/142/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/15/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/334/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/29/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/728/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/73/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/780/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/3/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/5/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/779/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/56/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/57/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/782/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/363/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/6/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/211/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/321/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/33/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/642/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/7/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/784/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/797/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/198/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/23/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/28/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/30/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/356/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/4/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/42/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/27/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/12/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/193/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/2/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/309/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/51/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/668/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/11/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/13/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/200/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/329/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/34/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/643/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/730/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/19/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/18/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/21/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/45/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/674/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/790/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/24/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/14/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/143/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/20/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/31/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/622/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/766/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/8/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/10/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/35/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf File opened for reading /proc/46/cmdline a4cc59f704798e6b3580a3cf3ee48320bb7267583aa99625850bc8891d4ca16f.elf