5c489f3782aa23fe0a4731d7b3e23b4dc110e25ddc1eecfecc40ccdeac5c71e8

Analysis

max time kernel
2s
max time network
154s
platform
debian-12_armhf
resource
debian12-armhf-20260127-en
resource tags

arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
29/10/2026, 21:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib/goProxy_armV7
Size 5.1MB
Sample261029-1qfp4stsct
SHA256 5c489f3782aa23fe0a4731d7b3e23b4dc110e25ddc1eecfecc40ccdeac5c71e8
MD5 a52b5f76d80cb7bfa9d40c7e7642dacd
SHA1 59839c0a6b9297f0ca9ae9747df8b21407a4a58b
SHA512 1ccb20050a8abf828ce925792229d5ddd12cfe7f341286552c362d8b517819d469d75f9e743045af0f96782b7767b7ff0d940574ddca0ac96fcd30d756a2c22a
SSDEEP 98304:XoGxeM+UgPbxEV/QFi1nKBymQ1HuAq4EWl0mJzmVmfhN6IgZ1gXtw8hMwF:JeDzxEUi1KVQvv0qmVmJEZaXt8wF
TLSH
T19B3633FABDF1190E57A8512EE29D7776C289DBB17FC05D05439AA4D086EB0BDE280DC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	goProxy_armV7
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	goProxy_armV7

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/mountinfo	goProxy_armV7
File opened for reading	/proc/self/cgroup	goProxy_armV7
File opened for reading	/proc/self/auxv	goProxy_armV7
File opened for reading	/proc/stat	goProxy_armV7
File opened for reading	/proc/sys/net/core/somaxconn	goProxy_armV7
File opened for reading	/proc/800/status	goProxy_armV7
File opened for reading	/proc/self/status	goProxy_armV7
File opened for reading	/proc/self/exe	goProxy_armV7

/tmp/lib/goProxy_armV7
/tmp/lib/goProxy_armV7
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads