Analysis
- max time kernel
131s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
22/10/2026, 18:19
Static task
static1
Behavioral task
behavioral1
Sample
manta.armv5l
Resource
debian12-armhf-20260513-en
debian-12-armhf
15 signatures
150 seconds
General
- Target manta.armv5l
- Size 1.3MB
- Sample261022-wydhhaww7p
- SHA256 7e94feb9c18ef4bec822a5919dc9db603656cf42532742b91be0db25eb4d4f80
- MD5 c3f60e34a7d5ac15581caf783f792db3
- SHA1 340149c5477ea66c1497f9459452408b565af334
- SHA512 6805514602ad91dab1ee43ada0c44594e976faa2ecf70d2385dc75d7a3ae7946274c1d2f32935460c738d24db6a57ed127f620b96c412ceab4b6060687e4f353
- SSDEEP 24576:fcLs9PEZOMQr6SPqxDManNAseOJE0+KJr:fdcZBQr72Qa
- TLSH T11B551965F880DFA1C6C06A7AF75D83A873134775D1DB7106CA198B383BF786E0A3A641
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Outbound SSH connection to public host 2 TTPs 64 IoCs
SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
description flow ioc SSH destination 648 83.92.60.46:22 SSH destination 1440 208.133.23.209:22 SSH destination 1674 25.24.44.45:22 SSH destination 1676 52.172.199.53:22 SSH destination 1678 207.35.245.236:22 SSH destination 39 202.71.188.171:22 SSH destination 411 160.3.10.147:22 SSH destination 658 177.143.116.17:22 SSH destination 1436 169.10.217.66:22 SSH destination 406 211.28.121.148:22 SSH destination 668 82.59.110.26:22 SSH destination 420 2.71.53.3:22 SSH destination 423 210.129.140.164:22 SSH destination 650 197.33.112.151:22 SSH destination 657 11.228.75.243:22 SSH destination 665 140.159.124.96:22 SSH destination 1675 199.193.85.181:22 SSH destination 1679 138.4.229.200:22 SSH destination 649 36.87.54.89:22 SSH destination 58 208.79.235.66:22 SSH destination 402 126.151.233.200:22 SSH destination 413 29.195.177.7:22 SSH destination 1666 88.107.0.173:22 SSH destination 38 161.21.194.222:22 SSH destination 42 43.66.146.139:22 SSH destination 45 109.78.119.44:22 SSH destination 647 158.248.136.149:22 SSH destination 1434 76.26.124.40:22 SSH destination 1682 109.45.150.109:22 SSH destination 404 39.154.72.24:22 SSH destination 409 32.69.144.18:22 SSH destination 1441 88.1.168.228:22 SSH destination 1443 60.110.22.227:22 SSH destination 1565 135.77.79.227:22 SSH destination 407 223.234.220.232:22 SSH destination 416 35.39.10.201:22 SSH destination 646 5.26.155.162:22 SSH destination 1425 129.208.113.123:22 SSH destination 1672 11.5.244.221:22 SSH destination 418 214.8.66.152:22 SSH destination 1444 187.138.241.190:22 SSH destination 1680 149.6.183.23:22 SSH destination 43 211.27.251.194:22 SSH destination 49 95.146.234.7:22 SSH destination 397 20.43.16.8:22 SSH destination 655 18.224.67.160:22 SSH destination 659 44.247.106.40:22 SSH destination 403 187.145.252.52:22 SSH destination 619 152.171.64.40:22 SSH destination 660 7.73.194.27:22 SSH destination 1431 83.103.190.54:22 SSH destination 1432 31.24.113.155:22 SSH destination 1665 79.222.101.59:22 SSH destination 53 128.124.157.245:22 SSH destination 374 98.61.143.169:22 SSH destination 1669 162.1.20.207:22 SSH destination 664 166.90.245.218:22 SSH destination 1426 93.197.62.19:22 SSH destination 1442 30.137.196.86:22 SSH destination 1671 44.10.27.40:22 SSH destination 408 16.165.155.75:22 SSH destination 414 218.193.156.210:22 SSH destination 415 212.182.4.75:22 SSH destination 1430 118.97.244.192:22 - Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/cron.d/manta manta.armv5l - Creates/modifies environment variables 1 TTPs 4 IoCs
Creating/modifying environment variables is a common persistence mechanism.
description ioc Process File opened for modification /root/.bashrc manta.armv5l File opened for modification /root/.profile manta.armv5l File opened for modification /etc/profile manta.armv5l File opened for modification /etc/bash.bashrc manta.armv5l - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp manta.armv5l - Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/manta manta.armv5l - Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc.local manta.armv5l - Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
description ioc Process File opened for modification /etc/systemd/system/manta.service manta.armv5l - Write file to user bin folder 1 IoCs
description ioc Process File opened for modification /usr/bin/.manta manta.armv5l - Modifies Bash startup script 2 TTPs 4 IoCs
description ioc Process File opened for modification /root/.bashrc manta.armv5l File opened for modification /root/.profile manta.armv5l File opened for modification /etc/profile manta.armv5l File opened for modification /etc/bash.bashrc manta.armv5l - Changes its process name 3 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself (sysv-install) 823 systemctl Changes the process name, possibly in an attempt to hide itself [kswapd0] 781 manta.armv5l Changes the process name, possibly in an attempt to hide itself [kworker/0:0] 881 manta.armv5l - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp manta.armv5l -
description ioc Process File opened for reading /proc/32/comm manta.armv5l File opened for reading /proc/730/comm manta.armv5l File opened for reading /proc/642/stat manta.armv5l File opened for reading /proc/7/comm manta.armv5l File opened for reading /proc/313/comm manta.armv5l File opened for reading /proc/778/comm manta.armv5l File opened for reading /proc/246/stat manta.armv5l File opened for reading /proc/341/stat manta.armv5l File opened for reading /proc/13/comm manta.armv5l File opened for reading /proc/10/stat manta.armv5l File opened for reading /proc/36/comm manta.armv5l File opened for reading /proc/28/stat manta.armv5l File opened for reading /proc/778/stat manta.armv5l File opened for reading /proc/9/comm manta.armv5l File opened for reading /proc/33/comm manta.armv5l File opened for reading /proc/73/comm manta.armv5l File opened for reading /proc/filesystems systemctl File opened for reading /proc/5/stat manta.armv5l File opened for reading /proc/31/stat manta.armv5l File opened for reading /proc/33/stat manta.armv5l File opened for reading /proc/791/comm manta.armv5l File opened for reading /proc/25/comm manta.armv5l File opened for reading /proc/34/comm manta.armv5l File opened for reading /proc/218/comm manta.armv5l File opened for reading /proc/641/comm manta.armv5l File opened for reading /proc/12/comm manta.armv5l File opened for reading /proc/21/comm manta.armv5l File opened for reading /proc/28/comm manta.armv5l File opened for reading /proc/filesystems systemctl File opened for reading /proc/16/comm manta.armv5l File opened for reading /proc/332/comm manta.armv5l File opened for reading /proc/filesystems systemctl File opened for reading /proc/18/stat manta.armv5l File opened for reading /proc/14/comm manta.armv5l File opened for reading /proc/5/comm manta.armv5l File opened for reading /proc/341/comm manta.armv5l File opened for reading /proc/143/stat manta.armv5l File opened for reading /proc/26/comm manta.armv5l File opened for reading /proc/44/comm manta.armv5l File opened for reading /proc/678/comm manta.armv5l File opened for reading /proc/meminfo manta.armv5l File opened for reading /proc/6/stat manta.armv5l File opened for reading /proc/21/stat manta.armv5l File opened for reading /proc/51/stat manta.armv5l File opened for reading /proc/777/stat manta.armv5l File opened for reading /proc/56/comm manta.armv5l File opened for reading /proc/57/comm manta.armv5l File opened for reading /proc/19/stat manta.armv5l File opened for reading /proc/20/stat manta.armv5l File opened for reading /proc/46/stat manta.armv5l File opened for reading /proc/3/comm manta.armv5l File opened for reading /proc/20/comm manta.armv5l File opened for reading /proc/317/comm manta.armv5l File opened for reading /proc/24/stat manta.armv5l File opened for reading /proc/25/stat manta.armv5l File opened for reading /proc/8/comm manta.armv5l File opened for reading /proc/201/comm manta.armv5l File opened for reading /proc/622/comm manta.armv5l File opened for reading /proc/24/comm manta.armv5l File opened for reading /proc/337/comm manta.armv5l File opened for reading /proc/15/comm manta.armv5l File opened for reading /proc/18/comm manta.armv5l File opened for reading /proc/193/comm manta.armv5l File opened for reading /proc/143/comm manta.armv5l - Writes file to shm directory 1 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
description ioc Process File opened for modification /dev/shm/.manta manta.armv5l - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.manta manta.armv5l
Processes
-
/tmp/manta.armv5l/tmp/manta.armv5l1⤵
- Creates/modifies Cron job
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Reads system network configuration
- Reads runtime system information
- Writes file to shm directory
- Writes file to tmp directory
PID:781 -
/bin/shsh -c -- "systemctl daemon-reload 2>/dev/null; systemctl enable manta.service 2>/dev/null"2⤵PID:801
-
/usr/bin/systemctlsystemctl daemon-reload3⤵
- Reads runtime system information
PID:802
-
-
/usr/bin/systemctlsystemctl enable manta.service3⤵
- Changes its process name
- Reads runtime system information
PID:822 -
/lib/systemd/systemd-sysv-install/lib/systemd/systemd-sysv-install enable manta4⤵PID:823
-
/usr/bin/getoptgetopt -o r: --long root: -- enable manta5⤵PID:824
-
-
/usr/sbin/update-rc.d/usr/sbin/update-rc.d manta defaults5⤵PID:825
-
/usr/local/sbin/systemctlsystemctl daemon-reload6⤵PID:826
-
-
/usr/local/bin/systemctlsystemctl daemon-reload6⤵PID:826
-
-
/usr/sbin/systemctlsystemctl daemon-reload6⤵PID:826
-
-
/usr/bin/systemctlsystemctl daemon-reload6⤵
- Reads runtime system information
PID:826
-
-
-
/usr/sbin/update-rc.d/usr/sbin/update-rc.d manta enable5⤵PID:844
-
/usr/local/sbin/systemctlsystemctl daemon-reload6⤵PID:845
-
-
/usr/local/bin/systemctlsystemctl daemon-reload6⤵PID:845
-
-
/usr/sbin/systemctlsystemctl daemon-reload6⤵PID:845
-
-
/usr/bin/systemctlsystemctl daemon-reload6⤵PID:845
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/cron.d/manta
- Size 55B
- SHA256 578f2be7115a3c8cdeac0ba77908ca377d6d20d4fc43b6d71eb9c82a5032dccd
- MD5 d36129024557ac13ba364dfc01ff38e9
- SHA1 fcf3898f871f34cff89153111f5dfbce3a6a18df
- SHA512 6b43bb8eae3b017c6bcf482800931e1ca81a9cfcae3eed039cac10f8eea4576a35891cb3e4c14cd6e47907ad6bd841619a631b201fed17889b61301d1f9c3173
- TLSH T1149002347C0043132050DCE0040441508521866401E8361040BCD07C801AB47A107885
- MD5 SHA1 SHA512 TLSH
- Path /etc/init.d/manta
- Size 255B
- SHA256 5dc4ce9efdaf5320fb385c5c991234cc60378975f84bf4cc9a5cdc76c8ce1dfe
- MD5 6fd4ab47a16a5fa137301a2ccb5b1d39
- SHA1 b3e2488ff27e93583c5dee88170de4e16faa9228
- SHA512 e4a9e80361a5ce197decad7a43b11109a63bba6adba8514c1d1d6722fc997263bb31d454b2625ec64d792fce4ee5e585da879c2e604ce5e3e84a1614e0e8b2bb
- TLSH T1AED02B432201BA2E3A4500808854E5815852C312111AA17AF05C17F41B57B43B03C160
- MD5 SHA1 SHA512 TLSH
- Path /etc/rc.local
- Size 33B
- SHA256 305ecbdf8aa90cee44b58ca18adb4224b1ad8376b64fdc6527825ae67504224f
- MD5 b73bec6314cf534a24d76777d9d84926
- SHA1 bbeab24e42fca6d5d622d21929f6d75ff807e3ad
- SHA512 bd287fd53671bda3e1c56bc549b30273443b141065fdf86cd43bb024ef1cbf7e058b14c5ec115e968cccc535136651261c27fc8bbbcf9c1f84c67c6fd0713dff
- MD5 SHA1 SHA512
- Path /etc/systemd/system/manta.service
- Size 195B
- SHA256 2790c9a3f7052b36cd5870af8b81029216c25c876c09e8149225370458c41995
- MD5 a7719163491c029b2554edf33e9586fa
- SHA1 ac8ce04e0798370b44f868fd379fcd067485065f
- SHA512 d20470f623610c542884dbfb99636019aea189855e40dabf0287c4bdd97ca356d136bd82fa2e7b3d74637cac16453ef1185b2da8b29705af57bb567ccd989f92
- TLSH T193D022227B0120E2D90F35B24EA79B108E200208058FF1700BE0054E06F3E4B5021EAE
- MD5 SHA1 SHA512 TLSH
- Path /tmp/.manta
- Size 1.3MB
- SHA256 7e94feb9c18ef4bec822a5919dc9db603656cf42532742b91be0db25eb4d4f80
- MD5 c3f60e34a7d5ac15581caf783f792db3
- SHA1 340149c5477ea66c1497f9459452408b565af334
- SHA512 6805514602ad91dab1ee43ada0c44594e976faa2ecf70d2385dc75d7a3ae7946274c1d2f32935460c738d24db6a57ed127f620b96c412ceab4b6060687e4f353
- SSDEEP 24576:fcLs9PEZOMQr6SPqxDManNAseOJE0+KJr:fdcZBQr72Qa
- TLSH T11B551965F880DFA1C6C06A7AF75D83A873134775D1DB7106CA198B383BF786E0A3A641
- MD5 SHA1 SHA512 SSDEEP TLSH