Analysis
-
max time kernel
152s -
max time network
154s -
platform
debian-9_armhf -
resource
debian9-armhf-20230831-en -
resource tags
arch:armhfimage:debian9-armhf-20230831-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
05-10-2023 16:14
Behavioral task
behavioral1
Sample
top1hbt.arm7.elf
Resource
debian9-armhf-20230831-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
top1hbt.arm7.elf
-
Size
175KB
-
MD5
57e2b6062192e93646cd64d6c0b774b8
-
SHA1
7fe6d7c8794a77a162b81bc15f10da7191013f72
-
SHA256
2bf8619215e2c564cee9a7aafab6694cd1f23911b0852285dbf35874091ed514
-
SHA512
5d895adbae72827de75143cf301d08fc3c8afd42291823c15aeee91de0e46fd2d5cc72599876ec467233144f34e3733dc00873737072596c2924fb4c5ed91a2a
-
SSDEEP
3072:nS/NsChjlvbAmfkIaboVSyckpj/HS0Bpxi/hJjogM/RXC/Ht6:nS/7lvlcIaboVS7kVdBHi/XMgM/RXC/0
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 380 top1hbt.arm7.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/417/cmdline File opened for reading /proc/445/cmdline File opened for reading /proc/485/cmdline File opened for reading /proc/4/cmdline File opened for reading /proc/379/cmdline File opened for reading /proc/399/cmdline File opened for reading /proc/444/cmdline File opened for reading /proc/447/cmdline File opened for reading /proc/459/cmdline File opened for reading /proc/7/cmdline File opened for reading /proc/10/cmdline File opened for reading /proc/22/cmdline File opened for reading /proc/245/cmdline File opened for reading /proc/400/cmdline File opened for reading /proc/414/cmdline File opened for reading /proc/434/cmdline File opened for reading /proc/481/cmdline File opened for reading /proc/382/cmdline File opened for reading /proc/466/cmdline File opened for reading /proc/468/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/18/cmdline File opened for reading /proc/472/cmdline File opened for reading /proc/482/cmdline File opened for reading /proc/321/cmdline File opened for reading /proc/405/cmdline File opened for reading /proc/423/cmdline File opened for reading /proc/431/cmdline File opened for reading /proc/454/cmdline File opened for reading /proc/474/cmdline File opened for reading /proc/478/cmdline File opened for reading /proc/401/cmdline File opened for reading /proc/430/cmdline File opened for reading /proc/389/cmdline File opened for reading /proc/409/cmdline File opened for reading /proc/470/cmdline File opened for reading /proc/25/cmdline File opened for reading /proc/80/cmdline File opened for reading /proc/243/cmdline File opened for reading /proc/376/cmdline File opened for reading /proc/12/cmdline File opened for reading /proc/282/cmdline File opened for reading /proc/298/cmdline File opened for reading /proc/11/cmdline File opened for reading /proc/42/cmdline File opened for reading /proc/102/cmdline File opened for reading /proc/150/cmdline File opened for reading /proc/439/cmdline File opened for reading /proc/458/cmdline File opened for reading /proc/171/cmdline File opened for reading /proc/247/cmdline File opened for reading /proc/383/cmdline File opened for reading /proc/422/cmdline File opened for reading /proc/443/cmdline File opened for reading /proc/112/cmdline File opened for reading /proc/136/cmdline File opened for reading /proc/393/cmdline File opened for reading /proc/421/cmdline File opened for reading /proc/433/cmdline File opened for reading /proc/460/cmdline File opened for reading /proc/5/cmdline File opened for reading /proc/27/cmdline File opened for reading /proc/28/cmdline File opened for reading /proc/43/cmdline