Analysis
- max time kernel
39s - max time network
42s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
23/09/2026, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
ypezhbfg.armv7
Resource
debian12-armhf-20260513-en
debian-12-armhf
8 signatures
40 seconds
General
- Target ypezhbfg.armv7
- Size 922KB
- Sample260923-2sjefswt3p
- SHA256 72a84f1fc61cdb3b08b005b004ec6f11f6c509bfeeca5a88725cefb14bb44f44
- MD5 16fe83d47a7de5617e16adcd26d8a515
- SHA1 f25f720abf2558058112b152aed8659171b912ad
- SHA512 92fe98b2435c53df43c7729be1ed720b1621017d48bd4f75fb94cad17d8bb29ec65bda5a18011d30e69ad38a34c743d83f34ba8af402a6b6eeee7ea45c365a32
- SSDEEP 24576:JYxIC+gqsIU27iAy+cMQRfb+zpH2K6k2hknuQ6J+:jwo+z4YK6k2hkOJ+
- TLSH T170154C55F890DF63C5D4677AF65E82A833234778C3D7720689148B383BA7A2F4B3A641
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/class/dmi/id/product_name ypezhbfg.armv7 File opened for reading /sys/class/dmi/id/sys_vendor ypezhbfg.armv7 File opened for reading /sys/class/dmi/id/bios_vendor ypezhbfg.armv7 File opened for reading /sys/class/dmi/id/board_vendor ypezhbfg.armv7 - Enumerates running processes
Discovers information about currently running processes on the system
- Reads MAC address of network interface 2 TTPs 2 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
description ioc Process File opened for reading /sys/class/net/lo/address ypezhbfg.armv7 File opened for reading /sys/class/net/eth0/address ypezhbfg.armv7 - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo ypezhbfg.armv7 - Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ypezhbfg.armv7 - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/class/net ypezhbfg.armv7 -
description ioc Process File opened for reading /proc/8/cmdline ypezhbfg.armv7 File opened for reading /proc/30/cmdline ypezhbfg.armv7 File opened for reading /proc/36/cmdline ypezhbfg.armv7 File opened for reading /proc/46/cmdline ypezhbfg.armv7 File opened for reading /proc/336/cmdline ypezhbfg.armv7 File opened for reading /proc/355/cmdline ypezhbfg.armv7 File opened for reading /proc/731/cmdline ypezhbfg.armv7 File opened for reading /proc/uptime ypezhbfg.armv7 File opened for reading /proc/5/cmdline ypezhbfg.armv7 File opened for reading /proc/14/cmdline ypezhbfg.armv7 File opened for reading /proc/35/cmdline ypezhbfg.armv7 File opened for reading /proc/193/cmdline ypezhbfg.armv7 File opened for reading /proc/340/cmdline ypezhbfg.armv7 File opened for reading /proc/728/cmdline ypezhbfg.armv7 File opened for reading /proc/779/cmdline ypezhbfg.armv7 File opened for reading /proc/13/cmdline ypezhbfg.armv7 File opened for reading /proc/51/cmdline ypezhbfg.armv7 File opened for reading /proc/788/cmdline ypezhbfg.armv7 File opened for reading /proc/849/cmdline ypezhbfg.armv7 File opened for reading /proc/7/cmdline ypezhbfg.armv7 File opened for reading /proc/33/cmdline ypezhbfg.armv7 File opened for reading /proc/45/cmdline ypezhbfg.armv7 File opened for reading /proc/642/cmdline ypezhbfg.armv7 File opened for reading /proc/1/cmdline ypezhbfg.armv7 File opened for reading /proc/6/cmdline ypezhbfg.armv7 File opened for reading /proc/15/cmdline ypezhbfg.armv7 File opened for reading /proc/22/cmdline ypezhbfg.armv7 File opened for reading /proc/367/cmdline ypezhbfg.armv7 File opened for reading /proc/625/cmdline ypezhbfg.armv7 File opened for reading /proc/16/cmdline ypezhbfg.armv7 File opened for reading /proc/29/cmdline ypezhbfg.armv7 File opened for reading /proc/34/cmdline ypezhbfg.armv7 File opened for reading /proc/56/cmdline ypezhbfg.armv7 File opened for reading /proc/4/cmdline ypezhbfg.armv7 File opened for reading /proc/20/cmdline ypezhbfg.armv7 File opened for reading /proc/21/cmdline ypezhbfg.armv7 File opened for reading /proc/25/cmdline ypezhbfg.armv7 File opened for reading /proc/217/cmdline ypezhbfg.armv7 File opened for reading /proc/316/cmdline ypezhbfg.armv7 File opened for reading /proc/2/cmdline ypezhbfg.armv7 File opened for reading /proc/18/cmdline ypezhbfg.armv7 File opened for reading /proc/19/cmdline ypezhbfg.armv7 File opened for reading /proc/42/cmdline ypezhbfg.armv7 File opened for reading /proc/198/cmdline ypezhbfg.armv7 File opened for reading /proc/314/cmdline ypezhbfg.armv7 File opened for reading /proc/352/cmdline ypezhbfg.armv7 File opened for reading /proc/31/cmdline ypezhbfg.armv7 File opened for reading /proc/3/cmdline ypezhbfg.armv7 File opened for reading /proc/12/cmdline ypezhbfg.armv7 File opened for reading /proc/17/cmdline ypezhbfg.armv7 File opened for reading /proc/142/cmdline ypezhbfg.armv7 File opened for reading /proc/331/cmdline ypezhbfg.armv7 File opened for reading /proc/10/cmdline ypezhbfg.armv7 File opened for reading /proc/315/cmdline ypezhbfg.armv7 File opened for reading /proc/641/cmdline ypezhbfg.armv7 File opened for reading /proc/769/cmdline ypezhbfg.armv7 File opened for reading /proc/789/cmdline ypezhbfg.armv7 File opened for reading /proc/23/cmdline ypezhbfg.armv7 File opened for reading /proc/28/cmdline ypezhbfg.armv7 File opened for reading /proc/32/cmdline ypezhbfg.armv7 File opened for reading /proc/143/cmdline ypezhbfg.armv7 File opened for reading /proc/780/cmdline ypezhbfg.armv7 File opened for reading /proc/784/cmdline ypezhbfg.armv7 File opened for reading /proc/252/cmdline ypezhbfg.armv7 - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.zl ypezhbfg.armv7