Analysis
- max time kernel
149s - max time network
149s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
02/10/2026, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
arm7
Resource
debian12-armhf-20260513-en
debian-12-armhf
6 signatures
150 seconds
General
- Target arm7
- Size 170KB
- Sample261002-pg389s1dld
- SHA256 9ae981175d5e8cf979faf9c4e3e13b3b8270c52a707b3ffc3e6f53b37ea091d2
- MD5 54db59a37268b4adcccb189b3d4be558
- SHA1 57ef8d287f67d50b2e299ae840a02ee3181e03b3
- SHA512 c973f993523454170271efd548046d84ace6ec84094af83553bd5ff9b008bcd868345833481b67f1cda768c38a180823b7dcc3f4394698f074a6ba7e48b049df
- SSDEEP 3072:wicAIc/ubcAA6glmTALz9A9qSRAD7d4f6Gd+xif7Vm+pT2zDf4ABrlbZu/:wie/c6TaA1Sqf6Gd+xA7PpqoALZ6
- TLSH T1D2040A56F990DE62C6D4267AFB5D429C335307B8D2D93102ED206F3C32EB95E0B3A646
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Renames itself 1 IoCs
pid Process 807 arm7 - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 1 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/1/maps arm7 - Changes its process name 4 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself uchttpd 807 arm7 Changes the process name, possibly in an attempt to hide itself upnpd 811 arm7 Changes the process name, possibly in an attempt to hide itself upnpd 812 arm7 Changes the process name, possibly in an attempt to hide itself upnpd 814 arm7 - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo arm7 -
description ioc Process File opened for reading /proc/1072/cmdline arm7 File opened for reading /proc/942/exe arm7 File opened for reading /proc/1060/cmdline arm7 File opened for reading /proc/18comm arm7 File opened for reading /proc/10/cmdline arm7 File opened for reading /proc/31/cmdline arm7 File opened for reading /proc/842/status arm7 File opened for reading /proc/895/cmdline arm7 File opened for reading /proc/1084/status arm7 File opened for reading /proc/731/cmdline arm7 File opened for reading /proc/1008/exe arm7 File opened for reading /proc/5/status arm7 File opened for reading /proc/1035/exe arm7 File opened for reading /proc/858/cmdline arm7 File opened for reading /proc/895/status arm7 File opened for reading /proc/1068/cmdline arm7 File opened for reading /proc/895/exe arm7 File opened for reading /proc/986/cmdline arm7 File opened for reading /proc/731comm arm7 File opened for reading /proc/11/cmdline arm7 File opened for reading /proc/785/cmdline arm7 File opened for reading /proc/922/status arm7 File opened for reading /proc/341comm arm7 File opened for reading /proc/45/status arm7 File opened for reading /proc/244/cmdline arm7 File opened for reading /proc/356/cmdline arm7 File opened for reading /proc/857/cmdline arm7 File opened for reading /proc/906/cmdline arm7 File opened for reading /proc/35comm arm7 File opened for reading /proc/810comm arm7 File opened for reading /proc/859/status arm7 File opened for reading /proc/910/cmdline arm7 File opened for reading /proc/1001/exe arm7 File opened for reading /proc/56comm arm7 File opened for reading /proc/316/cmdline arm7 File opened for reading /proc/917/cmdline arm7 File opened for reading /proc/1012/status arm7 File opened for reading /proc/17comm arm7 File opened for reading /proc/12/status arm7 File opened for reading /proc/19/status arm7 File opened for reading /proc/25/cmdline arm7 File opened for reading /proc/26/status arm7 File opened for reading /proc/850/status arm7 File opened for reading /proc/1039/status arm7 File opened for reading /proc/244comm arm7 File opened for reading /proc/777comm arm7 File opened for reading /proc/622/status arm7 File opened for reading /proc/142/status arm7 File opened for reading /proc/19/cmdline arm7 File opened for reading /proc/218/cmdline arm7 File opened for reading /proc/803/status arm7 File opened for reading /proc/735/cmdline arm7 File opened for reading /proc/966/cmdline arm7 File opened for reading /proc/970/exe arm7 File opened for reading /proc/25comm arm7 File opened for reading /proc/31/status arm7 File opened for reading /proc/777/status arm7 File opened for reading /proc/830/status arm7 File opened for reading /proc/839/exe arm7 File opened for reading /proc/914/exe arm7 File opened for reading /proc/998/exe arm7 File opened for reading /proc/28/cmdline arm7 File opened for reading /proc/777/cmdline arm7 File opened for reading /proc/839/status arm7