Analysis
- max time kernel
39s - max time network
42s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
24/09/2026, 02:53
Static task
static1
Behavioral task
behavioral1
Sample
acvdfpmy.arm
Resource
debian12-armhf-20260127-en
debian-12-armhf
8 signatures
40 seconds
General
- Target acvdfpmy.arm
- Size 922KB
- Sample260924-ddcrcscd65
- SHA256 681430f4b1bc6707005f6dc72f30cca63ccbdf5a71852945dc600383cdbaf8b8
- MD5 4726d6c2492364d8b03b650cc35a2f60
- SHA1 d30a087258740c950bba35ba6eb9b07585f942bc
- SHA512 0f1f84c01608e771d35f5e8ccc76c669facf13c4f920d12dc5d4d9090110d49172d0c2a280af7bb3c3a3e474d32be003745271caa8ae807581f2d4f6236ccb2c
- SSDEEP 24576:JYxIC+gqsIU27iAy+cMQRfb+zpH2K6k2hknuQ6J6:jwo+z4YK6k2hkOJ6
- TLSH T13F154C55F890DF63C5D4677AF65E82A833234778C3D7720689148B383BA7A2F4B3A641
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/class/dmi/id/product_name acvdfpmy.arm File opened for reading /sys/class/dmi/id/sys_vendor acvdfpmy.arm File opened for reading /sys/class/dmi/id/bios_vendor acvdfpmy.arm File opened for reading /sys/class/dmi/id/board_vendor acvdfpmy.arm - Enumerates running processes
Discovers information about currently running processes on the system
- Reads MAC address of network interface 2 TTPs 2 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
description ioc Process File opened for reading /sys/class/net/eth0/address acvdfpmy.arm File opened for reading /sys/class/net/lo/address acvdfpmy.arm - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo acvdfpmy.arm - Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online acvdfpmy.arm - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/class/net acvdfpmy.arm -
description ioc Process File opened for reading /proc/728/cmdline acvdfpmy.arm File opened for reading /proc/778/cmdline acvdfpmy.arm File opened for reading /proc/782/cmdline acvdfpmy.arm File opened for reading /proc/2/cmdline acvdfpmy.arm File opened for reading /proc/21/cmdline acvdfpmy.arm File opened for reading /proc/34/cmdline acvdfpmy.arm File opened for reading /proc/46/cmdline acvdfpmy.arm File opened for reading /proc/57/cmdline acvdfpmy.arm File opened for reading /proc/780/cmdline acvdfpmy.arm File opened for reading /proc/783/cmdline acvdfpmy.arm File opened for reading /proc/787/cmdline acvdfpmy.arm File opened for reading /proc/4/cmdline acvdfpmy.arm File opened for reading /proc/31/cmdline acvdfpmy.arm File opened for reading /proc/44/cmdline acvdfpmy.arm File opened for reading /proc/337/cmdline acvdfpmy.arm File opened for reading /proc/371/cmdline acvdfpmy.arm File opened for reading /proc/641/cmdline acvdfpmy.arm File opened for reading /proc/self/maps acvdfpmy.arm File opened for reading /proc/5/cmdline acvdfpmy.arm File opened for reading /proc/16/cmdline acvdfpmy.arm File opened for reading /proc/23/cmdline acvdfpmy.arm File opened for reading /proc/26/cmdline acvdfpmy.arm File opened for reading /proc/193/cmdline acvdfpmy.arm File opened for reading /proc/853/cmdline acvdfpmy.arm File opened for reading /proc/3/cmdline acvdfpmy.arm File opened for reading /proc/18/cmdline acvdfpmy.arm File opened for reading /proc/29/cmdline acvdfpmy.arm File opened for reading /proc/30/cmdline acvdfpmy.arm File opened for reading /proc/198/cmdline acvdfpmy.arm File opened for reading /proc/330/cmdline acvdfpmy.arm File opened for reading /proc/352/cmdline acvdfpmy.arm File opened for reading /proc/847/cmdline acvdfpmy.arm File opened for reading /proc/10/cmdline acvdfpmy.arm File opened for reading /proc/27/cmdline acvdfpmy.arm File opened for reading /proc/250/cmdline acvdfpmy.arm File opened for reading /proc/sys/kernel/hostname acvdfpmy.arm File opened for reading /proc/36/cmdline acvdfpmy.arm File opened for reading /proc/317/cmdline acvdfpmy.arm File opened for reading /proc/341/cmdline acvdfpmy.arm File opened for reading /proc/356/cmdline acvdfpmy.arm File opened for reading /proc/680/cmdline acvdfpmy.arm File opened for reading /proc/734/cmdline acvdfpmy.arm File opened for reading /proc/1/cmdline acvdfpmy.arm File opened for reading /proc/12/cmdline acvdfpmy.arm File opened for reading /proc/19/cmdline acvdfpmy.arm File opened for reading /proc/32/cmdline acvdfpmy.arm File opened for reading /proc/33/cmdline acvdfpmy.arm File opened for reading /proc/822/cmdline acvdfpmy.arm File opened for reading /proc/839/cmdline acvdfpmy.arm File opened for reading /proc/9/cmdline acvdfpmy.arm File opened for reading /proc/42/cmdline acvdfpmy.arm File opened for reading /proc/73/cmdline acvdfpmy.arm File opened for reading /proc/623/cmdline acvdfpmy.arm File opened for reading /proc/6/cmdline acvdfpmy.arm File opened for reading /proc/20/cmdline acvdfpmy.arm File opened for reading /proc/24/cmdline acvdfpmy.arm File opened for reading /proc/25/cmdline acvdfpmy.arm File opened for reading /proc/28/cmdline acvdfpmy.arm File opened for reading /proc/uptime acvdfpmy.arm File opened for reading /proc/35/cmdline acvdfpmy.arm File opened for reading /proc/45/cmdline acvdfpmy.arm File opened for reading /proc/142/cmdline acvdfpmy.arm File opened for reading /proc/218/cmdline acvdfpmy.arm File opened for reading /proc/8/cmdline acvdfpmy.arm - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.zl acvdfpmy.arm