Analysis
-
max time kernel
151s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20231026-en -
resource tags
arch:armhfimage:debian9-armhf-20231026-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
11-11-2023 09:08
Static task
static1
Behavioral task
behavioral1
Sample
mal
Resource
debian9-armhf-20231026-en
debian-9-armhf
6 signatures
150 seconds
General
-
Target
mal
-
Size
86KB
-
MD5
060295fd9e3a42449703524d9c184f96
-
SHA1
3b518191a06d94bbd7e379f27e0fd4115e803d65
-
SHA256
c7273e87c151953c82ce1081ed170630a51082d6f2f2ee36853a21cbe399b019
-
SHA512
2ab9ec7833b11cf9959a8f484a438aee404faa94721281a692e18b13e27f4868310c285d751b7169073a862340a66c7a2a7536014cc002f298393598863dbb6c
-
SSDEEP
1536:Ua4MyBX7SpHqoLwYtUeiLBrlqZ03sOAznRV7VFHockQEXUt/IEtXvMxMRYYOd1/S:UWyBX74qMKbO03I7fuGINNYO7/xbk
Score
7/10
Malware Config
Signatures
-
Changes its process name 3 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself l25dqa7d 666 Changes the process name, possibly in an attempt to hide itself 666 Changes the process name, possibly in an attempt to hide itself tauf72ppupch 769 -
Deletes itself 1 IoCs
pid 666 -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 8.26.56.26 Destination IP 9.9.9.9 Destination IP 64.6.64.6 Destination IP 84.200.69.80 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/15/cmdline File opened for reading /proc/16/cmdline File opened for reading /proc/23/cmdline File opened for reading /proc/589/cmdline File opened for reading /proc/590/cmdline File opened for reading /proc/645/cmdline File opened for reading /proc/4/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/771/cmdline File opened for reading /proc/19/cmdline File opened for reading /proc/21/cmdline File opened for reading /proc/113/cmdline File opened for reading /proc/649/cmdline File opened for reading /proc/590/exe File opened for reading /proc/2/cmdline File opened for reading /proc/12/cmdline File opened for reading /proc/155/cmdline File opened for reading /proc/288/cmdline File opened for reading /proc/316/cmdline File opened for reading /proc/587/cmdline File opened for reading /proc/277/exe File opened for reading /proc/24/cmdline File opened for reading /proc/25/cmdline File opened for reading /proc/777/exe File opened for reading /proc/83/cmdline File opened for reading /proc/103/cmdline File opened for reading /proc/22/cmdline File opened for reading /proc/41/cmdline File opened for reading /proc/583/cmdline File opened for reading /proc/648/cmdline File opened for reading /proc/316/exe File opened for reading /proc/320/exe File opened for reading /proc/1/cmdline File opened for reading /proc/9/cmdline File opened for reading /proc/781/exe File opened for reading /proc/273/cmdline File opened for reading /proc/787/cmdline File opened for reading /proc/11/cmdline File opened for reading /proc/145/cmdline File opened for reading /proc/763/cmdline File opened for reading /proc/583/exe File opened for reading /proc/773/cmdline File opened for reading /proc/781/cmdline File opened for reading /proc/785/exe File opened for reading /proc/116/cmdline File opened for reading /proc/603/cmdline File opened for reading /proc/603/exe File opened for reading /proc/670/exe File opened for reading /proc/779/cmdline File opened for reading /proc/6/cmdline File opened for reading /proc/666/cmdline File opened for reading /proc/777/cmdline File opened for reading /proc/42/cmdline File opened for reading /proc/311/exe File opened for reading /proc/43/cmdline File opened for reading /proc/150/cmdline File opened for reading /proc/8/cmdline File opened for reading /proc/17/cmdline File opened for reading /proc/274/cmdline File opened for reading /proc/289/exe File opened for reading /proc/153/cmdline File opened for reading /proc/277/cmdline File opened for reading /proc/308/exe File opened for reading /proc/20/cmdline -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc File opened for modification /tmp/tmp.lck