Analysis
-
max time kernel
155s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
01/01/2024, 23:00
Behavioral task
behavioral1
Sample
2afc9ae9d9603bbf620992c09c1331b2.elf
Resource
debian9-armhf-20231215-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
2afc9ae9d9603bbf620992c09c1331b2.elf
-
Size
130KB
-
MD5
2afc9ae9d9603bbf620992c09c1331b2
-
SHA1
129520ef5d4191480f20e120232eb6e6f8991822
-
SHA256
256aac8f53ba7a5f04d646c933a6653aa3da5fd5449020580d41b2406dbe0cef
-
SHA512
7bd40a2aa4154101217a6918f0ea00244729ea81947d3c9a609945819eadca6da202da0af2a985a233eb249ccd0a3067024f3ea0e15efa84b564db1ef24425d4
-
SSDEEP
3072:gHZ+X7AoyxFOV48wlP1z0RraPuk8d+Ow9L3sibH:gHZcA1AV48MP1zuQ9LsiT
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 650 2afc9ae9d9603bbf620992c09c1331b2.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/667/cmdline File opened for reading /proc/676/cmdline File opened for reading /proc/687/cmdline File opened for reading /proc/725/cmdline File opened for reading /proc/6/cmdline File opened for reading /proc/147/cmdline File opened for reading /proc/207/cmdline File opened for reading /proc/260/cmdline File opened for reading /proc/739/cmdline File opened for reading /proc/767/cmdline File opened for reading /proc/695/cmdline File opened for reading /proc/727/cmdline File opened for reading /proc/746/cmdline File opened for reading /proc/753/cmdline File opened for reading /proc/1/cmdline File opened for reading /proc/78/cmdline File opened for reading /proc/273/cmdline File opened for reading /proc/557/cmdline File opened for reading /proc/747/cmdline File opened for reading /proc/2/cmdline File opened for reading /proc/28/cmdline File opened for reading /proc/629/cmdline File opened for reading /proc/731/cmdline File opened for reading /proc/661/cmdline File opened for reading /proc/689/cmdline File opened for reading /proc/735/cmdline File opened for reading /proc/13/cmdline File opened for reading /proc/18/cmdline File opened for reading /proc/19/cmdline File opened for reading /proc/23/cmdline File opened for reading /proc/655/cmdline File opened for reading /proc/666/cmdline File opened for reading /proc/672/cmdline File opened for reading /proc/670/cmdline File opened for reading /proc/679/cmdline File opened for reading /proc/710/cmdline File opened for reading /proc/17/cmdline File opened for reading /proc/29/cmdline File opened for reading /proc/111/cmdline File opened for reading /proc/665/cmdline File opened for reading /proc/711/cmdline File opened for reading /proc/737/cmdline File opened for reading /proc/756/cmdline File opened for reading /proc/42/cmdline File opened for reading /proc/576/cmdline File opened for reading /proc/691/cmdline File opened for reading /proc/701/cmdline File opened for reading /proc/143/cmdline File opened for reading /proc/151/cmdline File opened for reading /proc/685/cmdline File opened for reading /proc/771/cmdline File opened for reading /proc/565/cmdline File opened for reading /proc/683/cmdline File opened for reading /proc/729/cmdline File opened for reading /proc/759/cmdline File opened for reading /proc/720/cmdline File opened for reading /proc/9/cmdline File opened for reading /proc/41/cmdline File opened for reading /proc/675/cmdline File opened for reading /proc/688/cmdline File opened for reading /proc/742/cmdline File opened for reading /proc/765/cmdline File opened for reading /proc/768/cmdline File opened for reading /proc/662/cmdline