Analysis
-
max time kernel
151s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20221111-en -
resource tags
arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
21/08/2023, 19:23
Behavioral task
behavioral1
Sample
e73a7c521b286d7dbe601016765d52545ae43469c731ded3b1d885c535492f82_JC.elf
Resource
debian9-armhf-20221111-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
e73a7c521b286d7dbe601016765d52545ae43469c731ded3b1d885c535492f82_JC.elf
-
Size
170KB
-
MD5
80cb62d8d967c90e04bc7e7eb10dce4c
-
SHA1
7e42eaa1acb0b48ea4d9defcbfb16be00a26072d
-
SHA256
e73a7c521b286d7dbe601016765d52545ae43469c731ded3b1d885c535492f82
-
SHA512
903ddaf95aadacc5e90170674f5837a6a274986aeac8fe59e794fccdbf16eeff66ba7b6589adc988e4940b72a3745c9b45f6254da664f2af328b2678b2c47d43
-
SSDEEP
3072:TxGto1Sg3ZkfaXxpF2kTthYzVVB5un/+ixvowM/RCKg5:H1SeSfaXxpFnTLGBIn/TywM/RCr
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 368 e73a7c521b286d7dbe601016765d52545ae43469c731ded3b1d885c535492f82_JC.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/482/cmdline File opened for reading /proc/370/cmdline File opened for reading /proc/406/cmdline File opened for reading /proc/430/cmdline File opened for reading /proc/397/cmdline File opened for reading /proc/398/cmdline File opened for reading /proc/433/cmdline File opened for reading /proc/446/cmdline File opened for reading /proc/464/cmdline File opened for reading /proc/376/cmdline File opened for reading /proc/392/cmdline File opened for reading /proc/394/cmdline File opened for reading /proc/478/cmdline File opened for reading /proc/1/cmdline File opened for reading /proc/447/cmdline File opened for reading /proc/391/cmdline File opened for reading /proc/437/cmdline File opened for reading /proc/459/cmdline File opened for reading /proc/469/cmdline File opened for reading /proc/495/cmdline File opened for reading /proc/24/cmdline File opened for reading /proc/112/cmdline File opened for reading /proc/386/cmdline File opened for reading /proc/431/cmdline File opened for reading /proc/449/cmdline File opened for reading /proc/285/cmdline File opened for reading /proc/357/cmdline File opened for reading /proc/422/cmdline File opened for reading /proc/323/cmdline File opened for reading /proc/439/cmdline File opened for reading /proc/472/cmdline File opened for reading /proc/416/cmdline File opened for reading /proc/465/cmdline File opened for reading /proc/43/cmdline File opened for reading /proc/100/cmdline File opened for reading /proc/418/cmdline File opened for reading /proc/429/cmdline File opened for reading /proc/8/cmdline File opened for reading /proc/9/cmdline File opened for reading /proc/13/cmdline File opened for reading /proc/371/cmdline File opened for reading /proc/409/cmdline File opened for reading /proc/420/cmdline File opened for reading /proc/471/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/16/cmdline File opened for reading /proc/367/cmdline File opened for reading /proc/379/cmdline File opened for reading /proc/443/cmdline File opened for reading /proc/463/cmdline File opened for reading /proc/4/cmdline File opened for reading /proc/294/cmdline File opened for reading /proc/322/cmdline File opened for reading /proc/378/cmdline File opened for reading /proc/474/cmdline File opened for reading /proc/283/cmdline File opened for reading /proc/445/cmdline File opened for reading /proc/448/cmdline File opened for reading /proc/485/cmdline File opened for reading /proc/2/cmdline File opened for reading /proc/22/cmdline File opened for reading /proc/79/cmdline File opened for reading /proc/425/cmdline File opened for reading /proc/451/cmdline