Analysis
- max time kernel
148s - max time network
139s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
30/09/2026, 11:01
Static task
static1
Behavioral task
behavioral1
Sample
armv6l.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target armv6l.elf
- Size 7.1MB
- Sample260930-m4n2razset
- SHA256 8b27f5319c4d7728bb2f7bb3c57b210c6fb55233572a8b8961683e05bca8781d
- MD5 4ae887ba0862fd0703477f709567c5d0
- SHA1 cb9d459efd3ff41fff1daef3a495b24e04c6591e
- SHA512 ea0019cfa475548353c89dd86a98a81e00b26af6544b75aab406f73df16e32bf1c70c243d6c1b7e1db47204afaecde6e0834277788f742335aedc06aa4b09c40
- SSDEEP 49152:yhAZIaD/mmG40x2VnrKfFQnVFDIhyjEWtxPllc78mHYegC45Eh:iuJmy0x2VnrKfFQrllc78KYegbEh
- TLSH T125761897B9924952C4E83A37BCBD81C432634EB99B87525B6D05FE383EBE1D90E34314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /lib/systemd/systemd-journald 797 armv6l.elf - Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max armv6l.elf File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size armv6l.elf -
description ioc Process File opened for reading /proc/6/environ armv6l.elf File opened for reading /proc/784/environ armv6l.elf File opened for reading /proc/143/environ armv6l.elf File opened for reading /proc/17/environ armv6l.elf File opened for reading /proc/18/stat armv6l.elf File opened for reading /proc/3/environ armv6l.elf File opened for reading /proc/32/stat armv6l.elf File opened for reading /proc/46/stat armv6l.elf File opened for reading /proc/5/stat armv6l.elf File opened for reading /proc/784/stat armv6l.elf File opened for reading /proc/36/stat armv6l.elf File opened for reading /proc/8/environ armv6l.elf File opened for reading /proc/9/stat armv6l.elf File opened for reading /proc/28/stat armv6l.elf File opened for reading /proc/35/stat armv6l.elf File opened for reading /proc/4/stat armv6l.elf File opened for reading /proc/44/stat armv6l.elf File opened for reading /proc/45/stat armv6l.elf File opened for reading /proc/8/stat armv6l.elf File opened for reading /proc/11/environ armv6l.elf File opened for reading /proc/14/environ armv6l.elf File opened for reading /proc/14/stat armv6l.elf File opened for reading /proc/3/stat armv6l.elf File opened for reading /proc/30/stat armv6l.elf File opened for reading /proc/32/environ armv6l.elf File opened for reading /proc/35/environ armv6l.elf File opened for reading /proc/4/environ armv6l.elf File opened for reading /proc/13/environ armv6l.elf File opened for reading /proc/25/stat armv6l.elf File opened for reading /proc/27/environ armv6l.elf File opened for reading /proc/57/stat armv6l.elf File opened for reading /proc/6/stat armv6l.elf File opened for reading /proc/73/stat armv6l.elf File opened for reading /proc/765/stat armv6l.elf File opened for reading /proc/29/stat armv6l.elf File opened for reading /proc/self/cgroup armv6l.elf File opened for reading /proc/19/environ armv6l.elf File opened for reading /proc/199/stat armv6l.elf File opened for reading /proc/21/stat armv6l.elf File opened for reading /proc/22/stat armv6l.elf File opened for reading /proc/34/stat armv6l.elf File opened for reading /proc/57/environ armv6l.elf File opened for reading /proc/17/stat armv6l.elf File opened for reading /proc/23/stat armv6l.elf File opened for reading /proc/26/environ armv6l.elf File opened for reading /proc/11/stat armv6l.elf File opened for reading /proc/12/stat armv6l.elf File opened for reading /proc/142/stat armv6l.elf File opened for reading /proc/15/stat armv6l.elf File opened for reading /proc/34/environ armv6l.elf File opened for reading /proc/51/environ armv6l.elf File opened for reading /proc/56/stat armv6l.elf File opened for reading /proc/self/auxv armv6l.elf File opened for reading /proc/197/stat armv6l.elf File opened for reading /proc/20/stat armv6l.elf File opened for reading /proc/24/stat armv6l.elf File opened for reading /proc/27/stat armv6l.elf File opened for reading /proc/45/environ armv6l.elf File opened for reading /proc/7/stat armv6l.elf File opened for reading /proc/765/environ armv6l.elf File opened for reading /proc/2/environ armv6l.elf File opened for reading /proc/30/environ armv6l.elf File opened for reading /proc/31/stat armv6l.elf File opened for reading /proc/10/stat armv6l.elf