Analysis
- max time kernel
149s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
16/09/2026, 16:03
Static task
static1
Behavioral task
behavioral1
Sample
armv4l.elf
Resource
debian12-armhf-20260127-en
debian-12-armhf
7 signatures
150 seconds
General
- Target armv4l.elf
- Size 744KB
- Sample260916-thfltasfmb
- SHA256 af1df1ffcc18c0304ea1ac75e9f7fe0738d4a3fe99df72367663d1166315fb7b
- MD5 596ac044ebf51ead3c86c6dc6e126e8b
- SHA1 e4afc76670711067909abe0d3f8a66ed8259c298
- SHA512 4e0b9a39757ffbfc804674fc3f8cb6d3568264c1b8a7f5e28ade7944e49187202988fc852c9a598869598c9d04bd8d7eba69a712bc0e1fd146c0d55d057ff591
- SSDEEP 12288:9rSIvHQ6A/IKUXS0XN6D727Y5Pp76QfQtdVT10HjKMN0sdx3Toi7qdPTk:9rfH9wkD6D72ePpItdKjnnDL72PT
- TLSH T17AF44B16FDA58F52C5C21A36FA8F424833234775E3D6F31A991497383A979BB4F2B201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 3 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/class/dmi/id/sys_vendor armv4l.elf File opened for reading /sys/class/dmi/id/board_vendor armv4l.elf File opened for reading /sys/class/dmi/id/product_name armv4l.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads MAC address of network interface 2 TTPs 1 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
description ioc Process File opened for reading /sys/class/net/eth0/address armv4l.elf - Reads network interface configuration 2 TTPs 2 IoCs
Fetches information about one or more active network interfaces.
description ioc Process File opened for reading /sys/class/net/eth0/flags armv4l.elf File opened for reading /sys/class/net/eth0/carrier armv4l.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself upnpd 778 armv4l.elf - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/class/net armv4l.elf -
description ioc Process File opened for reading /proc/25/cmdline armv4l.elf File opened for reading /proc/378/cmdline armv4l.elf File opened for reading /proc/13/status armv4l.elf File opened for reading /proc/787/cmdline armv4l.elf File opened for reading /proc/51/status armv4l.elf File opened for reading /proc/721/status armv4l.elf File opened for reading /proc/802/cmdline armv4l.elf File opened for reading /proc/45/cmdline armv4l.elf File opened for reading /proc/140/cmdline armv4l.elf File opened for reading /proc/785/status armv4l.elf File opened for reading /proc/792/status armv4l.elf File opened for reading /proc/46/cmdline armv4l.elf File opened for reading /proc/614/cmdline armv4l.elf File opened for reading /proc/762/cmdline armv4l.elf File opened for reading /proc/4/status armv4l.elf File opened for reading /proc/328/status armv4l.elf File opened for reading /proc/634/status armv4l.elf File opened for reading /proc/779/fd armv4l.elf File opened for reading /proc/802/fd armv4l.elf File opened for reading /proc/29/status armv4l.elf File opened for reading /proc/15/cmdline armv4l.elf File opened for reading /proc/27/cmdline armv4l.elf File opened for reading /proc/358/cmdline armv4l.elf File opened for reading /proc/777/cmdline armv4l.elf File opened for reading /proc/3/status armv4l.elf File opened for reading /proc/6/status armv4l.elf File opened for reading /proc/317/status armv4l.elf File opened for reading /proc/27/status armv4l.elf File opened for reading /proc/33/status armv4l.elf File opened for reading /proc/42/status armv4l.elf File opened for reading /proc/319/status armv4l.elf File opened for reading /proc/358/status armv4l.elf File opened for reading /proc/362/fd armv4l.elf File opened for reading /proc/790/cmdline armv4l.elf File opened for reading /proc/727/status armv4l.elf File opened for reading /proc/19/cmdline armv4l.elf File opened for reading /proc/20/cmdline armv4l.elf File opened for reading /proc/22/cmdline armv4l.elf File opened for reading /proc/44/cmdline armv4l.elf File opened for reading /proc/776/status armv4l.elf File opened for reading /proc/799/cmdline armv4l.elf File opened for reading /proc/32/cmdline armv4l.elf File opened for reading /proc/208/cmdline armv4l.elf File opened for reading /proc/1/status armv4l.elf File opened for reading /proc/196/status armv4l.elf File opened for reading /proc/670/status armv4l.elf File opened for reading /proc/1/cmdline armv4l.elf File opened for reading /proc/31/cmdline armv4l.elf File opened for reading /proc/51/cmdline armv4l.elf File opened for reading /proc/633/cmdline armv4l.elf File opened for reading /proc/16/status armv4l.elf File opened for reading /proc/676/fd armv4l.elf File opened for reading /proc/9/cmdline armv4l.elf File opened for reading /proc/26/cmdline armv4l.elf File opened for reading /proc/219/cmdline armv4l.elf File opened for reading /proc/314/cmdline armv4l.elf File opened for reading /proc/676/cmdline armv4l.elf File opened for reading /proc/727/cmdline armv4l.elf File opened for reading /proc/20/status armv4l.elf File opened for reading /proc/141/status armv4l.elf File opened for reading /proc/779/cmdline armv4l.elf File opened for reading /proc/11/status armv4l.elf File opened for reading /proc/19/status armv4l.elf File opened for reading /proc/57/status armv4l.elf