Analysis
- max time kernel
149s - max time network
140s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
30/09/2026, 00:19
Static task
static1
Behavioral task
behavioral1
Sample
armv4l.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
3 signatures
150 seconds
General
- Target armv4l.elf
- Size 1.7MB
- Sample260930-amarksaf52
- SHA256 c0fa389b23e4c7c8b8a5459e6d1c4a0a7db34a68e03b3d447d27437188ea7611
- MD5 f04f24410f758aa792dade1b91120dcb
- SHA1 99b1dc2968e852c9f653eadc2183c5512d4cf9d5
- SHA512 9bf6ae76a05a11faf61d2159a8279ddb05125cedd636d42c0d9df0dc7b51882f7935cfa57d988be8315eb1a3656ec498150d31bb753fdc4c2b59416691a75ea9
- SSDEEP 24576:2O5KdKdqOxD0SICA1mIyfCBkQxU+QCBW4WC5y08UBjS7:b5KKf9lIy8B
- TLSH T1628519A7BC428A42C4D425BBF97EA0C4334717B8D2EB7316ED05CA356ACF4994D3AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 4 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself locker 821 armv4l.elf Changes the process name, possibly in an attempt to hide itself killer 822 armv4l.elf Changes the process name, possibly in an attempt to hide itself scan-telnet 823 armv4l.elf Changes the process name, possibly in an attempt to hide itself scan-banner 824 armv4l.elf -
description ioc Process File opened for reading /proc/342/cmdline armv4l.elf File opened for reading /proc/829/cmdline armv4l.elf File opened for reading /proc/841/fd armv4l.elf File opened for reading /proc/843/cmdline armv4l.elf File opened for reading /proc/856/cmdline armv4l.elf File opened for reading /proc/13/cmdline armv4l.elf File opened for reading /proc/250/status armv4l.elf File opened for reading /proc/623/fd armv4l.elf File opened for reading /proc/642/status armv4l.elf File opened for reading /proc/25/cmdline armv4l.elf File opened for reading /proc/317/cmdline armv4l.elf File opened for reading /proc/382/status armv4l.elf File opened for reading /proc/829/status armv4l.elf File opened for reading /proc/855/cmdline armv4l.elf File opened for reading /proc/uptime armv4l.elf File opened for reading /proc/23/cmdline armv4l.elf File opened for reading /proc/218/cmdline armv4l.elf File opened for reading /proc/675/cmdline armv4l.elf File opened for reading /proc/729/cmdline armv4l.elf File opened for reading /proc/797/cmdline armv4l.elf File opened for reading /proc/839/cmdline armv4l.elf File opened for reading /proc/839/status armv4l.elf File opened for reading /proc/643/fd armv4l.elf File opened for reading /proc/5/cmdline armv4l.elf File opened for reading /proc/12/cmdline armv4l.elf File opened for reading /proc/643/cmdline armv4l.elf File opened for reading /proc/799/cmdline armv4l.elf File opened for reading /proc/840/cmdline armv4l.elf File opened for reading /proc/35/cmdline armv4l.elf File opened for reading /proc/45/cmdline armv4l.elf File opened for reading /proc/316/status armv4l.elf File opened for reading /proc/837/fd armv4l.elf File opened for reading /proc/853/cmdline armv4l.elf File opened for reading /proc/857/fd armv4l.elf File opened for reading /proc/36/cmdline armv4l.elf File opened for reading /proc/143/cmdline armv4l.elf File opened for reading /proc/643/status armv4l.elf File opened for reading /proc/819/fd armv4l.elf File opened for reading /proc/829/fd armv4l.elf File opened for reading /proc/857/cmdline armv4l.elf File opened for reading /proc/859/cmdline armv4l.elf File opened for reading /proc/863/status armv4l.elf File opened for reading /proc/342/status armv4l.elf File opened for reading /proc/846/fd armv4l.elf File opened for reading /proc/856/fd armv4l.elf File opened for reading /proc/861/status armv4l.elf File opened for reading /proc/14/cmdline armv4l.elf File opened for reading /proc/30/cmdline armv4l.elf File opened for reading /proc/356/cmdline armv4l.elf File opened for reading /proc/798/cmdline armv4l.elf File opened for reading /proc/332/status armv4l.elf File opened for reading /proc/791/status armv4l.elf File opened for reading /proc/835/cmdline armv4l.elf File opened for reading /proc/835/fd armv4l.elf File opened for reading /proc/795/cmdline armv4l.elf File opened for reading /proc/773/status armv4l.elf File opened for reading /proc/798/fd armv4l.elf File opened for reading /proc/839/fd armv4l.elf File opened for reading /proc/849/status armv4l.elf File opened for reading /proc/851/status armv4l.elf File opened for reading /proc/862/cmdline armv4l.elf File opened for reading /proc/42/cmdline armv4l.elf File opened for reading /proc/837/cmdline armv4l.elf File opened for reading /proc/15/cmdline armv4l.elf