Analysis
- max time kernel
141s - max time network
145s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
04/10/2026, 04:34
Static task
static1
Behavioral task
behavioral1
Sample
bioset0.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target bioset0.elf
- Size 5.9MB
- Sample261004-e7ba3agh83
- SHA256 0aad1879b98b2148b7035c848b1e71f4fa73678fdea2f15442d1552429684b6f
- MD5 879c31b3ba6858c6dd9abf9ce293e675
- SHA1 a59d8597e9a596baef36dfd20acabbb3034b5033
- SHA512 bf8db7cc65e44458ba75c50226a016e29da0c63de36f6afe0c5af926807d6e4fb8e221d44ad0cdf7cdcf0891b3fa3716f0017af888f6c3a99623d71c1bacbea6
- SSDEEP 49152:nPlvYX6nML0ppTblltGpTjx1xm73s+mEqi90/nOD1Og5EM:PbMAz3SSmX/nOD1DEM
- TLSH T141560897B8D24946C4E83677B8BE80C433635EB99B8A52566D05FE3C3EBE1D90E35304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size bioset0.elf -
description ioc Process File opened for reading /proc/768/cmdline bioset0.elf File opened for reading /proc/8/cmdline bioset0.elf File opened for reading /proc/10/cmdline bioset0.elf File opened for reading /proc/12/cmdline bioset0.elf File opened for reading /proc/31/cmdline bioset0.elf File opened for reading /proc/344/cmdline bioset0.elf File opened for reading /proc/733/cmdline bioset0.elf File opened for reading /proc/780/cmdline bioset0.elf File opened for reading /proc/781/cmdline bioset0.elf File opened for reading /proc/785/cmdline bioset0.elf File opened for reading /proc/22/cmdline bioset0.elf File opened for reading /proc/3/cmdline bioset0.elf File opened for reading /proc/341/cmdline bioset0.elf File opened for reading /proc/57/cmdline bioset0.elf File opened for reading /proc/7/cmdline bioset0.elf File opened for reading /proc/73/cmdline bioset0.elf File opened for reading /proc/317/cmdline bioset0.elf File opened for reading /proc/728/cmdline bioset0.elf File opened for reading /proc/44/cmdline bioset0.elf File opened for reading /proc/51/cmdline bioset0.elf File opened for reading /proc/11/cmdline bioset0.elf File opened for reading /proc/19/cmdline bioset0.elf File opened for reading /proc/220/cmdline bioset0.elf File opened for reading /proc/27/cmdline bioset0.elf File opened for reading /proc/800/cmdline bioset0.elf File opened for reading /proc/24/cmdline bioset0.elf File opened for reading /proc/243/cmdline bioset0.elf File opened for reading /proc/25/cmdline bioset0.elf File opened for reading /proc/198/cmdline bioset0.elf File opened for reading /proc/56/cmdline bioset0.elf File opened for reading /proc/28/cmdline bioset0.elf File opened for reading /proc/13/cmdline bioset0.elf File opened for reading /proc/208/cmdline bioset0.elf File opened for reading /proc/29/cmdline bioset0.elf File opened for reading /proc/735/cmdline bioset0.elf File opened for reading /proc/787/cmdline bioset0.elf File opened for reading /proc/9/cmdline bioset0.elf File opened for reading /proc/334/cmdline bioset0.elf File opened for reading /proc/360/cmdline bioset0.elf File opened for reading /proc/42/cmdline bioset0.elf File opened for reading /proc/35/cmdline bioset0.elf File opened for reading /proc/4/cmdline bioset0.elf File opened for reading /proc/36/cmdline bioset0.elf File opened for reading /proc/17/cmdline bioset0.elf File opened for reading /proc/2/cmdline bioset0.elf File opened for reading /proc/21/cmdline bioset0.elf File opened for reading /proc/314/cmdline bioset0.elf File opened for reading /proc/642/cmdline bioset0.elf File opened for reading /proc/672/cmdline bioset0.elf File opened for reading /proc/26/cmdline bioset0.elf File opened for reading /proc/14/cmdline bioset0.elf File opened for reading /proc/16/cmdline bioset0.elf File opened for reading /proc/20/cmdline bioset0.elf File opened for reading /proc/316/cmdline bioset0.elf File opened for reading /proc/641/cmdline bioset0.elf File opened for reading /proc/665/cmdline bioset0.elf File opened for reading /proc/18/cmdline bioset0.elf File opened for reading /proc/193/cmdline bioset0.elf File opened for reading /proc/33/cmdline bioset0.elf File opened for reading /proc/46/cmdline bioset0.elf File opened for reading /proc/23/cmdline bioset0.elf File opened for reading /proc/30/cmdline bioset0.elf File opened for reading /proc/34/cmdline bioset0.elf File opened for reading /proc/354/cmdline bioset0.elf - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.font-unix/.font0-lock bioset0.elf File opened for modification /tmp/.ICE-unix/.ICEauth bioset0.elf
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.ICE-unix/.ICEauth
- Size 5B
- SHA256 165bf75cce59f4a8aad5c4eb6f30bc21b9d5df31bde8dd63451efe91725004cf
- MD5 f4282888da6b156d42669da003273884
- SHA1 d3db448b98e463d8efce420e1ff4528106cafd72
- SHA512 4dcd698d988d4edd59c804ff85281bcb0ded66941d13aa788df0fd14b4d94cf64b81951dfc5903dd5c019fffac943c1ecdf2d7870404b0516231c15888139761
- MD5 SHA1 SHA512
- Path /tmp/.font-unix/.font0-lock
- Size 3B
- SHA256 9e04a49e5786695116f9af28552da3083d4eeb015294b878d27053439e363cdf
- MD5 4b04a686b0ad13dce35fa99fa4161c65
- SHA1 298f93b1b0efeaf41f0ce468d29abfd252985869
- SHA512 b5388de2f9a1f22aba01500f3f8b16c5bc2093cc20a5dc9939969f86b76e4d5aa2b4445b73bb8fdff0bd9b15d965e0ff7c51fe611a9ecbe7bea045bf73482983
- MD5 SHA1 SHA512