Analysis
- max time kernel
144s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
04/10/2026, 04:33
Behavioral task
behavioral1
Sample
kblockd0.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target kblockd0.elf
- Size 1.6MB
- Sample261004-e6pgast14k
- SHA256 2334ba8af1e64f074a98c6be8299e29b6eed8b048dd8a7f1cc98d078eea99984
- MD5 d74a87f45f139fea69866f0ff64901a6
- SHA1 e78e7517187bc4b3d16240c498ee01907ea5e393
- SHA512 5581a8aea7f0d5720e19606330879aab5c06964ff3b607216319d2aada87fd04dcabee259b272f82ac7d11713aa28933a5f0ef414e19ca048e180ccf1c6eef94
- SSDEEP 49152:hwJH7MTgq/R43vPlNrs7c2mVoWdVwhbZx6Fbj:hwJHw/KPAcFLdnbj
- TLSH T1F98533977B4EE24AC95FE43679DBA025CB809C94D1641D1274E5C4E033D2FEAE0A3B1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size kblockd0.elf -
description ioc Process File opened for reading /proc/782/cmdline kblockd0.elf File opened for reading /proc/345/cmdline kblockd0.elf File opened for reading /proc/373/cmdline kblockd0.elf File opened for reading /proc/643/cmdline kblockd0.elf File opened for reading /proc/7/cmdline kblockd0.elf File opened for reading /proc/4/cmdline kblockd0.elf File opened for reading /proc/684/cmdline kblockd0.elf File opened for reading /proc/779/cmdline kblockd0.elf File opened for reading /proc/3/cmdline kblockd0.elf File opened for reading /proc/312/cmdline kblockd0.elf File opened for reading /proc/342/cmdline kblockd0.elf File opened for reading /proc/794/cmdline kblockd0.elf File opened for reading /proc/16/cmdline kblockd0.elf File opened for reading /proc/26/cmdline kblockd0.elf File opened for reading /proc/317/cmdline kblockd0.elf File opened for reading /proc/335/cmdline kblockd0.elf File opened for reading /proc/12/cmdline kblockd0.elf File opened for reading /proc/17/cmdline kblockd0.elf File opened for reading /proc/217/cmdline kblockd0.elf File opened for reading /proc/319/cmdline kblockd0.elf File opened for reading /proc/45/cmdline kblockd0.elf File opened for reading /proc/22/cmdline kblockd0.elf File opened for reading /proc/29/cmdline kblockd0.elf File opened for reading /proc/9/cmdline kblockd0.elf File opened for reading /proc/144/cmdline kblockd0.elf File opened for reading /proc/361/cmdline kblockd0.elf File opened for reading /proc/43/cmdline kblockd0.elf File opened for reading /proc/624/cmdline kblockd0.elf File opened for reading /proc/735/cmdline kblockd0.elf File opened for reading /proc/766/cmdline kblockd0.elf File opened for reading /proc/10/cmdline kblockd0.elf File opened for reading /proc/27/cmdline kblockd0.elf File opened for reading /proc/46/cmdline kblockd0.elf File opened for reading /proc/20/cmdline kblockd0.elf File opened for reading /proc/21/cmdline kblockd0.elf File opened for reading /proc/34/cmdline kblockd0.elf File opened for reading /proc/729/cmdline kblockd0.elf File opened for reading /proc/57/cmdline kblockd0.elf File opened for reading /proc/13/cmdline kblockd0.elf File opened for reading /proc/14/cmdline kblockd0.elf File opened for reading /proc/15/cmdline kblockd0.elf File opened for reading /proc/194/cmdline kblockd0.elf File opened for reading /proc/31/cmdline kblockd0.elf File opened for reading /proc/32/cmdline kblockd0.elf File opened for reading /proc/356/cmdline kblockd0.elf File opened for reading /proc/self/exe kblockd0.elf File opened for reading /proc/11/cmdline kblockd0.elf File opened for reading /proc/23/cmdline kblockd0.elf File opened for reading /proc/251/cmdline kblockd0.elf File opened for reading /proc/47/cmdline kblockd0.elf File opened for reading /proc/788/cmdline kblockd0.elf File opened for reading /proc/795/cmdline kblockd0.elf File opened for reading /proc/6/cmdline kblockd0.elf File opened for reading /proc/1/cmdline kblockd0.elf File opened for reading /proc/143/cmdline kblockd0.elf File opened for reading /proc/2/cmdline kblockd0.elf File opened for reading /proc/33/cmdline kblockd0.elf File opened for reading /proc/35/cmdline kblockd0.elf File opened for reading /proc/644/cmdline kblockd0.elf File opened for reading /proc/781/cmdline kblockd0.elf File opened for reading /proc/36/cmdline kblockd0.elf File opened for reading /proc/38/cmdline kblockd0.elf File opened for reading /proc/677/cmdline kblockd0.elf File opened for reading /proc/74/cmdline kblockd0.elf - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.font-unix/.font0-lock kblockd0.elf File opened for modification /tmp/.ICE-unix/.ICEauth kblockd0.elf
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.ICE-unix/.ICEauth
- Size 5B
- SHA256 cdafe79078f984709086a0d9e74ac771d07e9f920d31192c0f40b34a824afbca
- MD5 d294a5c3eeff998a25743fb64eafbd26
- SHA1 ac7040419fef384e05d2bdf089d18b7296bc09b7
- SHA512 57927f6af5b5dfad6121e9f77ed725eabc2b5e44adc27f055d82817af46f4773d372af13cb656425028cd326d011ca7bb8e5b719a2d2035b7a205ededad2cc4b
- MD5 SHA1 SHA512
- Path /tmp/.font-unix/.font0-lock
- Size 3B
- SHA256 9e04a49e5786695116f9af28552da3083d4eeb015294b878d27053439e363cdf
- MD5 4b04a686b0ad13dce35fa99fa4161c65
- SHA1 298f93b1b0efeaf41f0ce468d29abfd252985869
- SHA512 b5388de2f9a1f22aba01500f3f8b16c5bc2093cc20a5dc9939969f86b76e4d5aa2b4445b73bb8fdff0bd9b15d965e0ff7c51fe611a9ecbe7bea045bf73482983
- MD5 SHA1 SHA512