Analysis
- max time kernel
150s - max time network
141s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
12/10/2026, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
main.armv7l.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
5 signatures
150 seconds
General
- Target main.armv7l.elf
- Size 60KB
- Sample261012-xerrfsdx4x
- SHA256 5e67407ff505b9e403fa6f5aa0a082c1e383814507a80e629b06220bfe0641b7
- MD5 a98db2522144f2c0896c642dc0f31ac5
- SHA1 731faf493320fda5c395f62cbecea5372d45defe
- SHA512 d9f3b14f5928f88a5d4de9ed1afbed8e5d60492e9ce9353da9f7977a0aea7194087c8f887d058d54a3b9a0a93b18d25f94eb7b88506bd905fc68cb9a674713ea
- SSDEEP 1536:HenCVzmqmxXYPSFrttZyKMHvnE9Glaynzi15GYQIyrS:L6DYaFrttZyKMv3U5Gh5r
- TLSH T1E353E749FA51AB19C9D231FAFB8E414E33176FA8E3F93120D9305F9023C5ADB0A76525
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 777 main.armv7l.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself init 777 main.armv7l.elf -
description ioc Process File opened for reading /proc/9/cmdline main.armv7l.elf File opened for reading /proc/10/cmdline main.armv7l.elf File opened for reading /proc/17/cmdline main.armv7l.elf File opened for reading /proc/242/cmdline main.armv7l.elf File opened for reading /proc/355/cmdline main.armv7l.elf File opened for reading /proc/774/cmdline main.armv7l.elf File opened for reading /proc/779/cmdline main.armv7l.elf File opened for reading /proc/27/cmdline main.armv7l.elf File opened for reading /proc/31/cmdline main.armv7l.elf File opened for reading /proc/73/cmdline main.armv7l.elf File opened for reading /proc/192/cmdline main.armv7l.elf File opened for reading /proc/217/cmdline main.armv7l.elf File opened for reading /proc/340/cmdline main.armv7l.elf File opened for reading /proc/773/cmdline main.armv7l.elf File opened for reading /proc/6/cmdline main.armv7l.elf File opened for reading /proc/16/cmdline main.armv7l.elf File opened for reading /proc/33/cmdline main.armv7l.elf File opened for reading /proc/46/cmdline main.armv7l.elf File opened for reading /proc/197/cmdline main.armv7l.elf File opened for reading /proc/199/cmdline main.armv7l.elf File opened for reading /proc/373/cmdline main.armv7l.elf File opened for reading /proc/56/cmdline main.armv7l.elf File opened for reading /proc/142/cmdline main.armv7l.elf File opened for reading /proc/351/cmdline main.armv7l.elf File opened for reading /proc/7/cmdline main.armv7l.elf File opened for reading /proc/674/cmdline main.armv7l.elf File opened for reading /proc/785/cmdline main.armv7l.elf File opened for reading /proc/789/cmdline main.armv7l.elf File opened for reading /proc/801/cmdline main.armv7l.elf File opened for reading /proc/804/cmdline main.armv7l.elf File opened for reading /proc/2/cmdline main.armv7l.elf File opened for reading /proc/19/cmdline main.armv7l.elf File opened for reading /proc/22/cmdline main.armv7l.elf File opened for reading /proc/29/cmdline main.armv7l.elf File opened for reading /proc/336/cmdline main.armv7l.elf File opened for reading /proc/3/cmdline main.armv7l.elf File opened for reading /proc/45/cmdline main.armv7l.elf File opened for reading /proc/141/cmdline main.armv7l.elf File opened for reading /proc/315/cmdline main.armv7l.elf File opened for reading /proc/799/cmdline main.armv7l.elf File opened for reading /proc/809/cmdline main.armv7l.elf File opened for reading /proc/18/cmdline main.armv7l.elf File opened for reading /proc/26/cmdline main.armv7l.elf File opened for reading /proc/28/cmdline main.armv7l.elf File opened for reading /proc/35/cmdline main.armv7l.elf File opened for reading /proc/316/cmdline main.armv7l.elf File opened for reading /proc/23/cmdline main.armv7l.elf File opened for reading /proc/30/cmdline main.armv7l.elf File opened for reading /proc/34/cmdline main.armv7l.elf File opened for reading /proc/44/cmdline main.armv7l.elf File opened for reading /proc/730/cmdline main.armv7l.elf File opened for reading /proc/793/cmdline main.armv7l.elf File opened for reading /proc/807/cmdline main.armv7l.elf File opened for reading /proc/32/cmdline main.armv7l.elf File opened for reading /proc/331/cmdline main.armv7l.elf File opened for reading /proc/680/cmdline main.armv7l.elf File opened for reading /proc/783/cmdline main.armv7l.elf File opened for reading /proc/803/cmdline main.armv7l.elf File opened for reading /proc/8/cmdline main.armv7l.elf File opened for reading /proc/11/cmdline main.armv7l.elf File opened for reading /proc/314/cmdline main.armv7l.elf File opened for reading /proc/621/cmdline main.armv7l.elf File opened for reading /proc/1/cmdline main.armv7l.elf File opened for reading /proc/12/cmdline main.armv7l.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.Kdat_tmp main.armv7l.elf