Analysis
- max time kernel
143s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
07/10/2026, 18:45
Behavioral task
behavioral1
Sample
sarm.elf
Resource
debian12-armhf-20260127-en
debian-12-armhf
2 signatures
150 seconds
General
- Target sarm.elf
- Size 457KB
- Sample261007-xeag6set2n
- SHA256 55e5ac325edb3954cb7978787e714787960d7dba711885b9ab0fec18251b1e51
- MD5 971edfe38b0c4b5a763f56a93ef91788
- SHA1 d6e7a091271cbd18a5b7f79f8a74fe8e9a955a98
- SHA512 abf6bb0a07ff06e6667219f054b83b58a51ec8fa774b902af1d114b213d689113d336f45000c4df68cb41e5684c8625cf1e57f57c5ee2752703ffa11a5883e15
- SSDEEP 12288:6n4xUhknfD00WmKr5Wxhlj5rynPpNpEgp7wTr:zYKfD0WKr5WxcPe
- TLSH T1AFA4E196F3473D82C4DBD939148AC6458B5AE16733F3D3053F47A5BA38292B24F29349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/642/cmdline sarm.elf File opened for reading /proc/6/cmdline sarm.elf File opened for reading /proc/12/cmdline sarm.elf File opened for reading /proc/22/cmdline sarm.elf File opened for reading /proc/23/cmdline sarm.elf File opened for reading /proc/765/cmdline sarm.elf File opened for reading /proc/777/cmdline sarm.elf File opened for reading /proc/782/cmdline sarm.elf File opened for reading /proc/809/cmdline sarm.elf File opened for reading /proc/193/cmdline sarm.elf File opened for reading /proc/323/cmdline sarm.elf File opened for reading /proc/4/cmdline sarm.elf File opened for reading /proc/24/cmdline sarm.elf File opened for reading /proc/26/cmdline sarm.elf File opened for reading /proc/359/cmdline sarm.elf File opened for reading /proc/17/cmdline sarm.elf File opened for reading /proc/73/cmdline sarm.elf File opened for reading /proc/18/cmdline sarm.elf File opened for reading /proc/20/cmdline sarm.elf File opened for reading /proc/143/cmdline sarm.elf File opened for reading /proc/316/cmdline sarm.elf File opened for reading /proc/677/cmdline sarm.elf File opened for reading /proc/5/cmdline sarm.elf File opened for reading /proc/14/cmdline sarm.elf File opened for reading /proc/25/cmdline sarm.elf File opened for reading /proc/27/cmdline sarm.elf File opened for reading /proc/326/cmdline sarm.elf File opened for reading /proc/376/cmdline sarm.elf File opened for reading /proc/807/cmdline sarm.elf File opened for reading /proc/16/cmdline sarm.elf File opened for reading /proc/7/cmdline sarm.elf File opened for reading /proc/34/cmdline sarm.elf File opened for reading /proc/35/cmdline sarm.elf File opened for reading /proc/46/cmdline sarm.elf File opened for reading /proc/142/cmdline sarm.elf File opened for reading /proc/256/cmdline sarm.elf File opened for reading /proc/622/cmdline sarm.elf File opened for reading /proc/30/cmdline sarm.elf File opened for reading /proc/44/cmdline sarm.elf File opened for reading /proc/315/cmdline sarm.elf File opened for reading /proc/804/cmdline sarm.elf File opened for reading /proc/19/cmdline sarm.elf File opened for reading /proc/309/cmdline sarm.elf File opened for reading /proc/683/cmdline sarm.elf File opened for reading /proc/57/cmdline sarm.elf File opened for reading /proc/3/cmdline sarm.elf File opened for reading /proc/21/cmdline sarm.elf File opened for reading /proc/28/cmdline sarm.elf File opened for reading /proc/42/cmdline sarm.elf File opened for reading /proc/45/cmdline sarm.elf File opened for reading /proc/728/cmdline sarm.elf File opened for reading /proc/732/cmdline sarm.elf File opened for reading /proc/51/cmdline sarm.elf File opened for reading /proc/211/cmdline sarm.elf File opened for reading /proc/399/cmdline sarm.elf File opened for reading /proc/803/cmdline sarm.elf File opened for reading /proc/1/cmdline sarm.elf File opened for reading /proc/8/cmdline sarm.elf File opened for reading /proc/9/cmdline sarm.elf File opened for reading /proc/15/cmdline sarm.elf File opened for reading /proc/36/cmdline sarm.elf File opened for reading /proc/198/cmdline sarm.elf File opened for reading /proc/385/cmdline sarm.elf File opened for reading /proc/641/cmdline sarm.elf