0927e4905d782c4cc8f48696b2698d77f4c588fd1ef5001ef2ebdceb834f3294

Analysis

max time kernel
11s
max time network
140s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
07/11/2026, 18:14

Target
Heyiwei-armv6l
Size 109KB
Sample261107-wvbvhaff23
SHA256 0927e4905d782c4cc8f48696b2698d77f4c588fd1ef5001ef2ebdceb834f3294
MD5 070ab9d31218c19b00a8ea3c61ded62d
SHA1 fd3d56a25a34a525c14f93d07c62ffb9ca717c3f
SHA512 771a1db1a16b671ba0f30cb70be334a15124eef4c35fff1d00983c4649f3d86ea86e59b461d5da5af062b6a48542f089824505f5c1905bc60ed8e4c3566efe46
SSDEEP 3072:vQuhHTcnMJiCVPw7eQ29PHYAY9RR5c2e:vQcIhCVPw7n29wZRRaZ
TLSH
T1C7B32998F890DB62CAD1267BFB4E428C33130779D3DA7102DD155B3427AB95B4F3AA06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/Heyiwei.FBgpEG	Heyiwei-armv6l

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	Heyiwei	804	Heyiwei-armv6l

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Heyiwei.lock	Heyiwei-armv6l

/tmp/Heyiwei-armv6l
/tmp/Heyiwei-armv6l
1⤵
- Write file to user bin folder
- Changes its process name
- Reads runtime system information
- Writes file to tmp directory
PID:804
- /usr/bin/systemctl
  /usr/bin/systemctl --no-ask-password daemon-reload
  2⤵
  - Reads runtime system information
  PID:814
- /usr/bin/systemctl
  /usr/bin/systemctl --no-ask-password enable Heyiwei.service
  2⤵
  - Reads runtime system information
  PID:867
- /usr/bin/systemctl
  /usr/bin/systemctl --no-ask-password start Heyiwei.service
  2⤵
  - Reads runtime system information
  PID:897