Analysis
- max time kernel
46s - max time network
152s - platform
debian-9_armhf - resource
debian9-armhf-20231222-en - resource tags
arch:armhfimage:debian9-armhf-20231222-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
08/01/2024, 01:03
Behavioral task
behavioral1
Sample
50d189225163e37c71a56460701bffb50255e93489bd08b32633d93dd0b59c36.elf
Resource
debian9-armhf-20231222-en
debian-9-armhf
5 signatures
150 seconds
General
- Target 50d189225163e37c71a56460701bffb50255e93489bd08b32633d93dd0b59c36.elf
- Size 146KB
- Sample240108-befhjaaef3
- SHA256 50d189225163e37c71a56460701bffb50255e93489bd08b32633d93dd0b59c36
- MD5 17396a608d325814a929dd801bb86861
- SHA1 8fc0eaceced14e73f0061b7c5c1384f00e29446a
- SHA512 ea9bc38fee3f26284302bc94e158d0cff402a241cc1e7ce13103bad200128e5519c44ddf54635a0db04683fe8f68c9de63a11aa198b89cd75cf87145d9307828
- SSDEEP 1536:QITylwTCPGasZQiqQX/AYuQQ4tbFoAGZ74VtwmETOJIoRBMbYBPdU2FlRsawywsT:QITUkvI41FoH4sJKJIoRV2YCyyH3c
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Contacts a large (47659) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself _@ 699 50d189225163e37c71a56460701bffb50255e93489bd08b32633d93dd0b59c36.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/708/status File opened for reading /proc/799/status File opened for reading /proc/297/status File opened for reading /proc/708/cmdline File opened for reading /proc/14/status File opened for reading /proc/153/status File opened for reading /proc/7/cmdline File opened for reading /proc/669/cmdline File opened for reading /proc/702/status File opened for reading /proc/602/cmdline File opened for reading /proc/43/cmdline File opened for reading /proc/314/cmdline File opened for reading /proc/795/cmdline File opened for reading /proc/11/status File opened for reading /proc/13/status File opened for reading /proc/1/cmdline File opened for reading /proc/16/cmdline File opened for reading /proc/18/cmdline File opened for reading /proc/29/cmdline File opened for reading /proc/333/cmdline File opened for reading /proc/3/status File opened for reading /proc/29/status File opened for reading /proc/164/status File opened for reading /proc/334/status File opened for reading /proc/12/cmdline File opened for reading /proc/24/cmdline File opened for reading /proc/300/cmdline File opened for reading /proc/42/status File opened for reading /proc/680/status File opened for reading /proc/700/status File opened for reading /proc/2/cmdline File opened for reading /proc/5/cmdline File opened for reading /proc/42/cmdline File opened for reading /proc/91/cmdline File opened for reading /proc/182/cmdline File opened for reading /proc/4/status File opened for reading /proc/301/status File opened for reading /proc/bus/cmdline File opened for reading /proc/795/status File opened for reading /proc/fs/cmdline File opened for reading /proc/sysvipc/cmdline File opened for reading /proc/26/cmdline File opened for reading /proc/744/cmdline File opened for reading /proc/24/status File opened for reading /proc/121/status File opened for reading /proc/333/status File opened for reading /proc/681/status File opened for reading /proc/633/cmdline File opened for reading /proc/7/status File opened for reading /proc/sys/cmdline File opened for reading /proc/23/cmdline File opened for reading /proc/334/cmdline File opened for reading /proc/300/status File opened for reading /proc/164/cmdline File opened for reading /proc/301/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/123/cmdline File opened for reading /proc/155/cmdline File opened for reading /proc/341/cmdline File opened for reading /proc/10/status File opened for reading /proc/602/status File opened for reading /proc/675/status File opened for reading /proc/driver/cmdline File opened for reading /proc/13/cmdline