Analysis
- max time kernel
149s - max time network
147s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
23/10/2026, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
iranbot-ultimate.armv4l.elf
Resource
debian12-armhf-20260127-en
debian-12-armhf
5 signatures
150 seconds
General
- Target iranbot-ultimate.armv4l.elf
- Size 97KB
- Sample261023-h2ryeaat9v
- SHA256 51209ddd399a406106b96e4c4742758d991982c74115bce7836cfea5cffe816e
- MD5 7dc8ba87c7d9ad8b9a33a31f14863ded
- SHA1 d87a540a4a400c91582b410456cba6d423032b23
- SHA512 4f58ab91923e423f7fbf16d79d5fc99be1cb1c7ec629c985195fd5955b4f420083d8303aa465803bdc279e5206f2e469d3feaca4fac45b5afae3cbe22707e72e
- SSDEEP 1536:+gynERvrY4Ke+aDBJdPH2jgmPUOBuB16OxKX/lw24dxgSn6al/vP5dKTOYXOz9Ah:+gynpc1/+sO28X224csr9P6Lmkv
- TLSH T1ABA31955F850EB26C6D026BAFB6D418C33530B78D3DA3106DE14AF3527FB91A4E3A906
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 806 iranbot-ultimate.armv4l.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/801/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/28/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/15/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/3/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/193/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/17/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/27/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/44/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/220/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/361/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/674/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/13/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/217/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/644/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/9/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/355/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/803/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/16/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/24/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/57/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/257/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/342/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/681/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/8/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/33/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/812/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/21/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/142/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/625/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/730/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/786/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/30/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/375/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/737/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/809/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/11/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/19/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/20/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/198/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/219/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/32/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/34/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/814/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/29/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/35/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/42/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/143/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/26/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/221/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/318/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/320/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/643/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/734/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/7/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/10/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/18/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/36/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/46/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/73/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/345/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/4/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/6/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/25/maps iranbot-ultimate.armv4l.elf File opened for reading /proc/45/maps iranbot-ultimate.armv4l.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself imissyou 806 iranbot-ultimate.armv4l.elf -
description ioc Process File opened for reading /proc/880/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/7/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/18/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/143/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/316/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/318/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/786/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/4/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/5/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/11/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/21/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/25/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/320/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/674/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/730/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/12/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/28/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/681/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/737/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/821/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/823/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/920/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/9/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/44/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/51/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/375/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/778/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/828/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/835/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/57/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/355/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/730/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/834/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/930/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/10/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/143/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/342/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/904/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/917/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/933/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/142/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/625/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/734/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/812/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/930/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/198/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/217/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/834/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/905/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/2/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/20/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/26/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/46/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/734/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/15/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/34/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/142/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/334/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/803/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/829/comm iranbot-ultimate.armv4l.elf File opened for reading /proc/6/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/16/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/20/stat iranbot-ultimate.armv4l.elf File opened for reading /proc/25/stat iranbot-ultimate.armv4l.elf