2292a27faf7d19f62e59b0a79792e4b75ff72779a78105b86900fff637fb343e

Analysis

max time kernel
120s
max time network
142s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
03/10/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
linux-armv6.elf
Size 5.6MB
Sample261003-vgf2masgre
SHA256 2292a27faf7d19f62e59b0a79792e4b75ff72779a78105b86900fff637fb343e
MD5 139c2d5d90287a6fe6a11e92b609e173
SHA1 2d7b236902ab5945d5ef3e7797ce74c2218e2970
SHA512 45b973c6032c65cdb82fcfb48bd1dc9b867dee4324e97b1c2d8ace1c6c70c457cc4fe4a869908a59fb45c800be9ee2d2ebee5c0359034a7b5489bae01b0b6e53
SSDEEP 49152:eQ4fjp5nHRSHTYXjO9GxqeTvjKFZo24F1gr8zD5E8:CN9gQOW2pRr8xE8
TLSH
T1E1461797B8924942C4E8363BBCBE81C433635EB99B8652576D05FE3C3ABE1D90E34354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	linux-armv6.elf
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	linux-armv6.elf
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	linux-armv6.elf
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	linux-armv6.elf

Reads runtime system information 5 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/cgroup	linux-armv6.elf
File opened for reading	/proc/meminfo	linux-armv6.elf
File opened for reading	/proc/self/mountinfo	linux-armv6.elf
File opened for reading	/proc/self/cgroup	linux-armv6.elf
File opened for reading	/proc/self/mountinfo	linux-armv6.elf

/tmp/linux-armv6.elf
/tmp/linux-armv6.elf
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:784
- /tmp/linux-armv6.elf
  /tmp/linux-armv6.elf
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads