Analysis
- max time kernel
149s - max time network
153s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
16/09/2026, 18:31
Static task
static1
Behavioral task
behavioral1
Sample
iran.armv7l
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target iran.armv7l
- Size 142KB
- Sample260916-w6hgesel21
- SHA256 8c32e78ad04be0a22f515dc5d8e183895fa6ca64034e829b38f3ffd7b0eeeb60
- MD5 1b7d2ec8f7b10530d7a8686890ff52f3
- SHA1 31fe67807356831951218a6b6d462c0eacb487ca
- SHA512 6e5753d6d766016058ecd6a31f4ca964623e405943cc86825d59ac2d2c19ad5023872ed336cb2f97294e559b68e70694cd6f8d191367f0175ec8f57bfaa908e9
- SSDEEP 3072:6nZpD+/4jw0P4GmyvC/frevbzQpgMCa5bo0nIQc0r9vI2mmCULXJWcsw0:6nZpD+/4jw0PpfvCazzQvCalfnIQc0rw
- TLSH T1F4E30749ED42AB00D5D636FAFE4E428973535B6CE3FE71129E245B2127CA92B0F7B101
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/xs.main iran.armv7l - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself -sh 786 iran.armv7l -
description ioc Process File opened for reading /proc/2/cmdline iran.armv7l File opened for reading /proc/26/status iran.armv7l File opened for reading /proc/51/status iran.armv7l File opened for reading /proc/336/comm iran.armv7l File opened for reading /proc/6/comm iran.armv7l File opened for reading /proc/29/stat iran.armv7l File opened for reading /proc/45/status iran.armv7l File opened for reading /proc/208/exe iran.armv7l File opened for reading /proc/762/exe iran.armv7l File opened for reading /proc/794/comm iran.armv7l File opened for reading /proc/23/status iran.armv7l File opened for reading /proc/26/stat iran.armv7l File opened for reading /proc/773/comm iran.armv7l File opened for reading /proc/20/cmdline iran.armv7l File opened for reading /proc/21/cmdline iran.armv7l File opened for reading /proc/28/cmdline iran.armv7l File opened for reading /proc/9/comm iran.armv7l File opened for reading /proc/11/comm iran.armv7l File opened for reading /proc/18/stat iran.armv7l File opened for reading /proc/19/status iran.armv7l File opened for reading /proc/25/stat iran.armv7l File opened for reading /proc/29/cmdline iran.armv7l File opened for reading /proc/31/cmdline iran.armv7l File opened for reading /proc/42/stat iran.armv7l File opened for reading /proc/45/comm iran.armv7l File opened for reading /proc/17/stat iran.armv7l File opened for reading /proc/45/stat iran.armv7l File opened for reading /proc/360/cmdline iran.armv7l File opened for reading /proc/14/comm iran.armv7l File opened for reading /proc/5/status iran.armv7l File opened for reading /proc/16/stat iran.armv7l File opened for reading /proc/32/cmdline iran.armv7l File opened for reading /proc/802/status iran.armv7l File opened for reading /proc/810/cmdline iran.armv7l File opened for reading /proc/1/comm iran.armv7l File opened for reading /proc/57/comm iran.armv7l File opened for reading /proc/4/status iran.armv7l File opened for reading /proc/15/status iran.armv7l File opened for reading /proc/18/status iran.armv7l File opened for reading /proc/19/stat iran.armv7l File opened for reading /proc/51/comm iran.armv7l File opened for reading /proc/16/cmdline iran.armv7l File opened for reading /proc/33/status iran.armv7l File opened for reading /proc/46/cmdline iran.armv7l File opened for reading /proc/3/stat iran.armv7l File opened for reading /proc/32/stat iran.armv7l File opened for reading /proc/56/stat iran.armv7l File opened for reading /proc/32/comm iran.armv7l File opened for reading /proc/22/stat iran.armv7l File opened for reading /proc/30/cmdline iran.armv7l File opened for reading /proc/56/comm iran.armv7l File opened for reading /proc/671/comm iran.armv7l File opened for reading /proc/731/comm iran.armv7l File opened for reading /proc/4/cmdline iran.armv7l File opened for reading /proc/17/cmdline iran.armv7l File opened for reading /proc/18/cmdline iran.armv7l File opened for reading /proc/24/cmdline iran.armv7l File opened for reading /proc/42/cmdline iran.armv7l File opened for reading /proc/42/comm iran.armv7l File opened for reading /proc/7/cmdline iran.armv7l File opened for reading /proc/142/status iran.armv7l File opened for reading /proc/208/status iran.armv7l File opened for reading /proc/791/status iran.armv7l File opened for reading /proc/807/stat iran.armv7l
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/init.d/xs.main
- Size 28B
- SHA256 5b0ccb787e4294422900cbf0da6ed5959672076d370df967b7cf1f5130755160
- MD5 e01d78c244ac547a3c2b2d9b4cd59d72
- SHA1 f70adf758a1a6afbbfbf8dd6ea2407651ee23e90
- SHA512 5b828a245bbb51159251c619985840be3e3b2fa3c3ff2ce8b29661075db9c9c7dea4f2cf8218b3c83ad6e8ea8c06c2f49e227690d7bb497bee0ce95a511182de
- MD5 SHA1 SHA512