Analysis
- max time kernel
150s - max time network
144s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
20/09/2026, 16:00
Static task
static1
Behavioral task
behavioral1
Sample
armv5l.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
7 signatures
150 seconds
General
- Target armv5l.elf
- Size 627KB
- Sample260920-tft2esda87
- SHA256 c40f75eccdca4fbe21f4c79a7b46df138bf7db13baa2aa1277f077d3bc520121
- MD5 0abdaaa3b3ac3079f4d6a69939832fe1
- SHA1 2b34909810dee80bd3177324b722b30c6398fdc1
- SHA512 90fe2b851bec01b9214797506e64f2a8151d39cce1a7ff24d68f6d8bbd5fb5368c5b522d35bc73ff27e25cf6c0c49d297cc1d5b7e9ddc0d0dff03a742aaa29da
- SSDEEP 12288:ZrRUtdkepif3ENp484hR6+IREoJFBMw96xVBA4pzeCMiTxcNzWlC:mickRLzBLjTxcZWl
- TLSH T1BBD4AF55FD59EE93C4B2D236CCBBC2917136E8AE9BE2C315290A517C3C172399F19388
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 3 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/class/dmi/id/product_name armv5l.elf File opened for reading /sys/class/dmi/id/sys_vendor armv5l.elf File opened for reading /sys/class/dmi/id/board_vendor armv5l.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads MAC address of network interface 2 TTPs 1 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
description ioc Process File opened for reading /sys/class/net/eth0/address armv5l.elf - Reads network interface configuration 2 TTPs 2 IoCs
Fetches information about one or more active network interfaces.
description ioc Process File opened for reading /sys/class/net/eth0/flags armv5l.elf File opened for reading /sys/class/net/eth0/carrier armv5l.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself upnpd 788 armv5l.elf - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/class/net armv5l.elf -
description ioc Process File opened for reading /proc/17/cmdline armv5l.elf File opened for reading /proc/17/status armv5l.elf File opened for reading /proc/27/status armv5l.elf File opened for reading /proc/734/fd armv5l.elf File opened for reading /proc/804/status armv5l.elf File opened for reading /proc/291/cmdline armv5l.elf File opened for reading /proc/796/cmdline armv5l.elf File opened for reading /proc/20/status armv5l.elf File opened for reading /proc/34/status armv5l.elf File opened for reading /proc/35/status armv5l.elf File opened for reading /proc/57/status armv5l.elf File opened for reading /proc/142/status armv5l.elf File opened for reading /proc/291/status armv5l.elf File opened for reading /proc/21/status armv5l.elf File opened for reading /proc/31/status armv5l.elf File opened for reading /proc/368/status armv5l.elf File opened for reading /proc/734/status armv5l.elf File opened for reading /proc/806/status armv5l.elf File opened for reading /proc/42/cmdline armv5l.elf File opened for reading /proc/198/status armv5l.elf File opened for reading /proc/623/status armv5l.elf File opened for reading /proc/731/status armv5l.elf File opened for reading /proc/783/fd armv5l.elf File opened for reading /proc/785/status armv5l.elf File opened for reading /proc/789/status armv5l.elf File opened for reading /proc/6/cmdline armv5l.elf File opened for reading /proc/22/cmdline armv5l.elf File opened for reading /proc/33/cmdline armv5l.elf File opened for reading /proc/26/status armv5l.elf File opened for reading /proc/33/status armv5l.elf File opened for reading /proc/36/status armv5l.elf File opened for reading /proc/681/cmdline armv5l.elf File opened for reading /proc/359/status armv5l.elf File opened for reading /proc/801/fd armv5l.elf File opened for reading /proc/2/cmdline armv5l.elf File opened for reading /proc/36/cmdline armv5l.elf File opened for reading /proc/193/cmdline armv5l.elf File opened for reading /proc/789/cmdline armv5l.elf File opened for reading /proc/18/status armv5l.elf File opened for reading /proc/357/status armv5l.elf File opened for reading /proc/795/status armv5l.elf File opened for reading /proc/804/cmdline armv5l.elf File opened for reading /proc/12/cmdline armv5l.elf File opened for reading /proc/19/cmdline armv5l.elf File opened for reading /proc/20/cmdline armv5l.elf File opened for reading /proc/142/cmdline armv5l.elf File opened for reading /proc/806/cmdline armv5l.elf File opened for reading /proc/13/cmdline armv5l.elf File opened for reading /proc/772/cmdline armv5l.elf File opened for reading /proc/801/cmdline armv5l.elf File opened for reading /proc/288/status armv5l.elf File opened for reading /proc/288/fd armv5l.elf File opened for reading /proc/623/fd armv5l.elf File opened for reading /proc/26/cmdline armv5l.elf File opened for reading /proc/359/fd armv5l.elf File opened for reading /proc/360/status armv5l.elf File opened for reading /proc/783/status armv5l.elf File opened for reading /proc/807/cmdline armv5l.elf File opened for reading /proc/623/cmdline armv5l.elf File opened for reading /proc/19/status armv5l.elf File opened for reading /proc/342/status armv5l.elf File opened for reading /proc/641/status armv5l.elf File opened for reading /proc/3/cmdline armv5l.elf File opened for reading /proc/4/cmdline armv5l.elf