Analysis
-
max time kernel
151s -
max time network
153s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
resource tags
arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
07-10-2023 01:36
Behavioral task
behavioral1
Sample
2bf8619215e2c564cee9a7aafab6694cd1f23911b0852285dbf35874091ed514.elf
Resource
debian9-armhf-en-20211208
debian-9-armhf
3 signatures
150 seconds
General
-
Target
2bf8619215e2c564cee9a7aafab6694cd1f23911b0852285dbf35874091ed514.elf
-
Size
175KB
-
MD5
57e2b6062192e93646cd64d6c0b774b8
-
SHA1
7fe6d7c8794a77a162b81bc15f10da7191013f72
-
SHA256
2bf8619215e2c564cee9a7aafab6694cd1f23911b0852285dbf35874091ed514
-
SHA512
5d895adbae72827de75143cf301d08fc3c8afd42291823c15aeee91de0e46fd2d5cc72599876ec467233144f34e3733dc00873737072596c2924fb4c5ed91a2a
-
SSDEEP
3072:nS/NsChjlvbAmfkIaboVSyckpj/HS0Bpxi/hJjogM/RXC/Ht6:nS/7lvlcIaboVS7kVdBHi/XMgM/RXC/0
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 367 2bf8619215e2c564cee9a7aafab6694cd1f23911b0852285dbf35874091ed514.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/402/cmdline File opened for reading /proc/403/cmdline File opened for reading /proc/1/cmdline File opened for reading /proc/23/cmdline File opened for reading /proc/131/cmdline File opened for reading /proc/368/cmdline File opened for reading /proc/390/cmdline File opened for reading /proc/95/cmdline File opened for reading /proc/366/cmdline File opened for reading /proc/398/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/17/cmdline File opened for reading /proc/21/cmdline File opened for reading /proc/41/cmdline File opened for reading /proc/74/cmdline File opened for reading /proc/8/cmdline File opened for reading /proc/28/cmdline File opened for reading /proc/374/cmdline File opened for reading /proc/375/cmdline File opened for reading /proc/376/cmdline File opened for reading /proc/323/cmdline File opened for reading /proc/389/cmdline File opened for reading /proc/10/cmdline File opened for reading /proc/11/cmdline File opened for reading /proc/42/cmdline File opened for reading /proc/104/cmdline File opened for reading /proc/145/cmdline File opened for reading /proc/107/cmdline File opened for reading /proc/226/cmdline File opened for reading /proc/269/cmdline File opened for reading /proc/387/cmdline File opened for reading /proc/365/cmdline File opened for reading /proc/395/cmdline File opened for reading /proc/399/cmdline File opened for reading /proc/24/cmdline File opened for reading /proc/361/cmdline File opened for reading /proc/362/cmdline File opened for reading /proc/384/cmdline File opened for reading /proc/16/cmdline File opened for reading /proc/139/cmdline File opened for reading /proc/161/cmdline File opened for reading /proc/378/cmdline File opened for reading /proc/397/cmdline File opened for reading /proc/27/cmdline File opened for reading /proc/235/cmdline File opened for reading /proc/236/cmdline File opened for reading /proc/3/cmdline File opened for reading /proc/4/cmdline File opened for reading /proc/6/cmdline File opened for reading /proc/9/cmdline File opened for reading /proc/13/cmdline File opened for reading /proc/377/cmdline File opened for reading /proc/383/cmdline File opened for reading /proc/385/cmdline File opened for reading /proc/400/cmdline File opened for reading /proc/386/cmdline File opened for reading /proc/401/cmdline File opened for reading /proc/404/cmdline File opened for reading /proc/19/cmdline File opened for reading /proc/278/cmdline File opened for reading /proc/316/cmdline File opened for reading /proc/320/cmdline File opened for reading /proc/322/cmdline File opened for reading /proc/29/cmdline