Analysis
- max time kernel
149s - max time network
144s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
30/09/2026, 10:50
Static task
static1
Behavioral task
behavioral1
Sample
armv5l.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target armv5l.elf
- Size 7.2MB
- Sample260930-mxgdbsdc27
- SHA256 85f3ba9c0931811d89c8589ad58a49642cbd384c82eccdb5faf9c9b31c474f74
- MD5 06e042b49091a92394f73a9b79d6623a
- SHA1 ea7544c09ba0f087457d3d8588a380a316afda83
- SHA512 d0c32d01bca95a039d106616ea6f4d31644a30886ebdcb90e25a562b0cdd421860278211f278a40d0552212bbd96a9e25e6bae0c2b145e55b54121638c83c3a6
- SSDEEP 49152:lurd3HLMuYI5cR3H9JA3iRH1FmyhPPpmwaHo91xwh9FsipWe+n45Et:MrOuG3fA3iRH1FyGwh9Fsy9Et
- TLSH T1F0761997B9D24952C4E83A37BCBD80C432631EB99B87521A6D05FE387EBE5D90E34314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/lib/fwupd/fwupd 791 armv5l.elf - Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size armv5l.elf File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max armv5l.elf -
description ioc Process File opened for reading /proc/32/stat armv5l.elf File opened for reading /proc/56/environ armv5l.elf File opened for reading /proc/778/stat armv5l.elf File opened for reading /proc/3/environ armv5l.elf File opened for reading /proc/208/environ armv5l.elf File opened for reading /proc/26/environ armv5l.elf File opened for reading /proc/30/stat armv5l.elf File opened for reading /proc/34/stat armv5l.elf File opened for reading /proc/4/stat armv5l.elf File opened for reading /proc/42/stat armv5l.elf File opened for reading /proc/57/stat armv5l.elf File opened for reading /proc/12/environ armv5l.elf File opened for reading /proc/14/stat armv5l.elf File opened for reading /proc/143/environ armv5l.elf File opened for reading /proc/16/stat armv5l.elf File opened for reading /proc/26/stat armv5l.elf File opened for reading /proc/46/stat armv5l.elf File opened for reading /proc/51/stat armv5l.elf File opened for reading /proc/777/environ armv5l.elf File opened for reading /proc/14/environ armv5l.elf File opened for reading /proc/2/stat armv5l.elf File opened for reading /proc/208/stat armv5l.elf File opened for reading /proc/28/stat armv5l.elf File opened for reading /proc/732/environ armv5l.elf File opened for reading /proc/778/environ armv5l.elf File opened for reading /proc/self/mountinfo armv5l.elf File opened for reading /proc/13/environ armv5l.elf File opened for reading /proc/198/stat armv5l.elf File opened for reading /proc/21/stat armv5l.elf File opened for reading /proc/777/stat armv5l.elf File opened for reading /proc/798/stat armv5l.elf File opened for reading /proc/8/environ armv5l.elf File opened for reading /proc/17/stat armv5l.elf File opened for reading /proc/25/environ armv5l.elf File opened for reading /proc/31/environ armv5l.elf File opened for reading /proc/34/environ armv5l.elf File opened for reading /proc/36/environ armv5l.elf File opened for reading /proc/4/environ armv5l.elf File opened for reading /proc/44/environ armv5l.elf File opened for reading /proc/51/environ armv5l.elf File opened for reading /proc/self/cgroup armv5l.elf File opened for reading /proc/10/environ armv5l.elf File opened for reading /proc/22/environ armv5l.elf File opened for reading /proc/29/stat armv5l.elf File opened for reading /proc/45/environ armv5l.elf File opened for reading /proc/6/stat armv5l.elf File opened for reading /proc/7/environ armv5l.elf File opened for reading /proc/15/environ armv5l.elf File opened for reading /proc/15/stat armv5l.elf File opened for reading /proc/11/environ armv5l.elf File opened for reading /proc/2/environ armv5l.elf File opened for reading /proc/209/environ armv5l.elf File opened for reading /proc/23/environ armv5l.elf File opened for reading /proc/3/stat armv5l.elf File opened for reading /proc/31/stat armv5l.elf File opened for reading /proc/33/stat armv5l.elf File opened for reading /proc/5/stat armv5l.elf File opened for reading /proc/10/stat armv5l.elf File opened for reading /proc/11/stat armv5l.elf File opened for reading /proc/20/environ armv5l.elf File opened for reading /proc/20/stat armv5l.elf File opened for reading /proc/209/stat armv5l.elf File opened for reading /proc/24/stat armv5l.elf File opened for reading /proc/25/stat armv5l.elf