Analysis
- max time kernel
139s - max time network
144s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
04/10/2026, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
kblockd0.elf
Resource
debian12-armhf-20260127-en
debian-12-armhf
4 signatures
150 seconds
General
- Target kblockd0.elf
- Size 5.9MB
- Sample261004-e7xjasvya1
- SHA256 eead4ced63cc53508d205537583eca3ed32ac2aba488ff55d4ff2153b645d350
- MD5 b582553bd57c47f82d34dc73c8ee4082
- SHA1 0ed94b5e577ec6ef9c67627ad0f812e476f205f9
- SHA512 5c1d34b933eabd60d0c5fe6e1f5963f45e2089d271d662580210a96a78cbbb8ca02ac3a558e645fb3bea6302a78523610e7f06340fc3543a5eb01f0a500eeb70
- SSDEEP 49152:MC+Ud92PpZFUS+6WtrcPUFT2kXsNXqUd+g5Ei:p+UT5i9qUdTEi
- TLSH T1AF560857B8D24942C4E83637B8BE81C433635EBA9B8A52566D05FE3C3EBE1D90E35314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size kblockd0.elf -
description ioc Process File opened for reading /proc/35/cmdline kblockd0.elf File opened for reading /proc/734/cmdline kblockd0.elf File opened for reading /proc/142/cmdline kblockd0.elf File opened for reading /proc/334/cmdline kblockd0.elf File opened for reading /proc/641/cmdline kblockd0.elf File opened for reading /proc/14/cmdline kblockd0.elf File opened for reading /proc/20/cmdline kblockd0.elf File opened for reading /proc/316/cmdline kblockd0.elf File opened for reading /proc/350/cmdline kblockd0.elf File opened for reading /proc/46/cmdline kblockd0.elf File opened for reading /proc/673/cmdline kblockd0.elf File opened for reading /proc/787/cmdline kblockd0.elf File opened for reading /proc/796/cmdline kblockd0.elf File opened for reading /proc/19/cmdline kblockd0.elf File opened for reading /proc/30/cmdline kblockd0.elf File opened for reading /proc/12/cmdline kblockd0.elf File opened for reading /proc/21/cmdline kblockd0.elf File opened for reading /proc/3/cmdline kblockd0.elf File opened for reading /proc/642/cmdline kblockd0.elf File opened for reading /proc/193/cmdline kblockd0.elf File opened for reading /proc/25/cmdline kblockd0.elf File opened for reading /proc/332/cmdline kblockd0.elf File opened for reading /proc/42/cmdline kblockd0.elf File opened for reading /proc/6/cmdline kblockd0.elf File opened for reading /proc/622/cmdline kblockd0.elf File opened for reading /proc/11/cmdline kblockd0.elf File opened for reading /proc/27/cmdline kblockd0.elf File opened for reading /proc/29/cmdline kblockd0.elf File opened for reading /proc/317/cmdline kblockd0.elf File opened for reading /proc/7/cmdline kblockd0.elf File opened for reading /proc/786/cmdline kblockd0.elf File opened for reading /proc/33/cmdline kblockd0.elf File opened for reading /proc/668/cmdline kblockd0.elf File opened for reading /proc/73/cmdline kblockd0.elf File opened for reading /proc/34/cmdline kblockd0.elf File opened for reading /proc/51/cmdline kblockd0.elf File opened for reading /proc/728/cmdline kblockd0.elf File opened for reading /proc/780/cmdline kblockd0.elf File opened for reading /proc/9/cmdline kblockd0.elf File opened for reading /proc/143/cmdline kblockd0.elf File opened for reading /proc/198/cmdline kblockd0.elf File opened for reading /proc/313/cmdline kblockd0.elf File opened for reading /proc/13/cmdline kblockd0.elf File opened for reading /proc/364/cmdline kblockd0.elf File opened for reading /proc/45/cmdline kblockd0.elf File opened for reading /proc/57/cmdline kblockd0.elf File opened for reading /proc/730/cmdline kblockd0.elf File opened for reading /proc/781/cmdline kblockd0.elf File opened for reading /proc/218/cmdline kblockd0.elf File opened for reading /proc/23/cmdline kblockd0.elf File opened for reading /proc/766/cmdline kblockd0.elf File opened for reading /proc/784/cmdline kblockd0.elf File opened for reading /proc/26/cmdline kblockd0.elf File opened for reading /proc/355/cmdline kblockd0.elf File opened for reading /proc/36/cmdline kblockd0.elf File opened for reading /proc/44/cmdline kblockd0.elf File opened for reading /proc/8/cmdline kblockd0.elf File opened for reading /proc/1/cmdline kblockd0.elf File opened for reading /proc/10/cmdline kblockd0.elf File opened for reading /proc/16/cmdline kblockd0.elf File opened for reading /proc/2/cmdline kblockd0.elf File opened for reading /proc/24/cmdline kblockd0.elf File opened for reading /proc/254/cmdline kblockd0.elf File opened for reading /proc/31/cmdline kblockd0.elf - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.font-unix/.font0-lock kblockd0.elf File opened for modification /tmp/.ICE-unix/.ICEauth kblockd0.elf
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.ICE-unix/.ICEauth
- Size 4B
- SHA256 56e7d0f9102dc9e7e8332efb45940a43d37bb1e1134ff71fc8f2c799ca645466
- MD5 c3820b5d63029210c43d4b357b03f19d
- SHA1 b510a57a5ec8fb45d945fee5a056f98eb1c783fb
- SHA512 82ca4a745cefa29108abdb372fbc35d5f1377eb8e0fb6e2540f4d6b327fdba8036623b9e2055f04a1c5f59ca219bf5c6d755ca015e7fcc01f50083ab371087eb
- MD5 SHA1 SHA512
- Path /tmp/.font-unix/.font0-lock
- Size 3B
- SHA256 ff108b68b0e9bc1e5a744f80f9ef1b8575c7d041eeb3e8d2eae300347de6e7fc
- MD5 fc8001f834f6a5f0561080d134d53d29
- SHA1 aa5076f800ef52b2ed0f0b8d88bfc68f7fd6a314
- SHA512 0d95e596cf47aadc35a4fb1880c9f05f03352496461c3f0715c54b2328b2f8d4c09e55464bde9b140508fc68386c6b30af4c40b1557c1e1486eb802352fedf22
- MD5 SHA1 SHA512