Analysis
- max time kernel
137s - max time network
141s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
04/10/2026, 04:34
Static task
static1
Behavioral task
behavioral1
Sample
jbd2_sda1d.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target jbd2_sda1d.elf
- Size 5.9MB
- Sample261004-e7b8csgh84
- SHA256 f4107a863ce5d1ae604ec953b5b6c9d3b2f125fc735038bd1a819164d4bf4c5d
- MD5 a892303e1bb0aeb08b92fd63581eb70b
- SHA1 f46708762585623afb779ad7158fe15ad282a5ac
- SHA512 693d566186d39bab8d6ad320cbf426c82d6441cf68981476c192dc8822c1d172df3d0e67604e896fc2209bc0eb72de6985dc80bca6db4b4492ead9ba0bd1fee5
- SSDEEP 49152:En/QwQcaNGOkSw28XUoWWqamNLhwP+UmHb/oEeMGPYag5Ez:EntwoxWpJwP+XPEz
- TLSH T1C2560857B8D24942C4E83637B8BD81C433635EBA9B8A52676D05EE3C3EBE1D90E35704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size jbd2_sda1d.elf -
description ioc Process File opened for reading /proc/734/cmdline jbd2_sda1d.elf File opened for reading /proc/779/cmdline jbd2_sda1d.elf File opened for reading /proc/11/cmdline jbd2_sda1d.elf File opened for reading /proc/198/cmdline jbd2_sda1d.elf File opened for reading /proc/30/cmdline jbd2_sda1d.elf File opened for reading /proc/314/cmdline jbd2_sda1d.elf File opened for reading /proc/46/cmdline jbd2_sda1d.elf File opened for reading /proc/51/cmdline jbd2_sda1d.elf File opened for reading /proc/57/cmdline jbd2_sda1d.elf File opened for reading /proc/641/cmdline jbd2_sda1d.elf File opened for reading /proc/26/cmdline jbd2_sda1d.elf File opened for reading /proc/340/cmdline jbd2_sda1d.elf File opened for reading /proc/6/cmdline jbd2_sda1d.elf File opened for reading /proc/728/cmdline jbd2_sda1d.elf File opened for reading /proc/731/cmdline jbd2_sda1d.elf File opened for reading /proc/790/cmdline jbd2_sda1d.elf File opened for reading /proc/355/cmdline jbd2_sda1d.elf File opened for reading /proc/782/cmdline jbd2_sda1d.elf File opened for reading /proc/787/cmdline jbd2_sda1d.elf File opened for reading /proc/17/cmdline jbd2_sda1d.elf File opened for reading /proc/252/cmdline jbd2_sda1d.elf File opened for reading /proc/29/cmdline jbd2_sda1d.elf File opened for reading /proc/42/cmdline jbd2_sda1d.elf File opened for reading /proc/7/cmdline jbd2_sda1d.elf File opened for reading /proc/18/cmdline jbd2_sda1d.elf File opened for reading /proc/19/cmdline jbd2_sda1d.elf File opened for reading /proc/56/cmdline jbd2_sda1d.elf File opened for reading /proc/24/cmdline jbd2_sda1d.elf File opened for reading /proc/28/cmdline jbd2_sda1d.elf File opened for reading /proc/315/cmdline jbd2_sda1d.elf File opened for reading /proc/73/cmdline jbd2_sda1d.elf File opened for reading /proc/788/cmdline jbd2_sda1d.elf File opened for reading /proc/2/cmdline jbd2_sda1d.elf File opened for reading /proc/217/cmdline jbd2_sda1d.elf File opened for reading /proc/22/cmdline jbd2_sda1d.elf File opened for reading /proc/35/cmdline jbd2_sda1d.elf File opened for reading /proc/5/cmdline jbd2_sda1d.elf File opened for reading /proc/13/cmdline jbd2_sda1d.elf File opened for reading /proc/25/cmdline jbd2_sda1d.elf File opened for reading /proc/316/cmdline jbd2_sda1d.elf File opened for reading /proc/336/cmdline jbd2_sda1d.elf File opened for reading /proc/36/cmdline jbd2_sda1d.elf File opened for reading /proc/623/cmdline jbd2_sda1d.elf File opened for reading /proc/777/cmdline jbd2_sda1d.elf File opened for reading /proc/783/cmdline jbd2_sda1d.elf File opened for reading /proc/193/cmdline jbd2_sda1d.elf File opened for reading /proc/642/cmdline jbd2_sda1d.elf File opened for reading /proc/801/cmdline jbd2_sda1d.elf File opened for reading /proc/9/cmdline jbd2_sda1d.elf File opened for reading /proc/10/cmdline jbd2_sda1d.elf File opened for reading /proc/12/cmdline jbd2_sda1d.elf File opened for reading /proc/16/cmdline jbd2_sda1d.elf File opened for reading /proc/32/cmdline jbd2_sda1d.elf File opened for reading /proc/679/cmdline jbd2_sda1d.elf File opened for reading /proc/331/cmdline jbd2_sda1d.elf File opened for reading /proc/8/cmdline jbd2_sda1d.elf File opened for reading /proc/142/cmdline jbd2_sda1d.elf File opened for reading /proc/33/cmdline jbd2_sda1d.elf File opened for reading /proc/367/cmdline jbd2_sda1d.elf File opened for reading /proc/625/cmdline jbd2_sda1d.elf File opened for reading /proc/674/cmdline jbd2_sda1d.elf File opened for reading /proc/780/cmdline jbd2_sda1d.elf File opened for reading /proc/23/cmdline jbd2_sda1d.elf File opened for reading /proc/44/cmdline jbd2_sda1d.elf - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.font-unix/.font0-lock jbd2_sda1d.elf File opened for modification /tmp/.ICE-unix/.ICEauth jbd2_sda1d.elf
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.ICE-unix/.ICEauth
- Size 4B
- SHA256 fa7e7a853ea882d571670d575d3fad2a6802e85822bfcf7fe596e2de7addd295
- MD5 1e0316add6ca90270304c7c40452a893
- SHA1 24c51baf8fad75b604f370d00f6829f4b4b9b9bb
- SHA512 771b0a8db6610eb3d980fbf8bba0b54b5c17c7d588420b24d47a59bcdf24386eaf5e0c3e79478cf200ff559de5872f07d399e67cd2b79dd5d804be878193f49b
- MD5 SHA1 SHA512
- Path /tmp/.font-unix/.font0-lock
- Size 3B
- SHA256 fc091d39524c9d4b5b11f84f9132996a94ca01c9816d2db3b866bef1b0699d91
- MD5 3621f1454cacf995530ea53652ddf8fb
- SHA1 e00988f42f7fc5f14ec6a0e7905789110f23c5de
- SHA512 91c7c628260e2e2a8120254dcee4228759a969e3faefd517f4dd1cdd54a6fb95e8a6ae8f488fe64017fc666637c27016b92fdbeb256332ea70bcad9cf3037673
- MD5 SHA1 SHA512