Analysis
-
max time kernel
153s -
max time network
152s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
12/02/2024, 03:42
Behavioral task
behavioral1
Sample
377ff63aed8929367fe0634b55d9230df07496cd8ef75de7741c94c0a726c08c.elf
Resource
debian9-armhf-20231215-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
377ff63aed8929367fe0634b55d9230df07496cd8ef75de7741c94c0a726c08c.elf
-
Size
130KB
-
MD5
78bb5feef87a2a83623b1d34b29a62ba
-
SHA1
bbd7d57b2f7ea054d8ef2d4e3a74b3622f2b050e
-
SHA256
377ff63aed8929367fe0634b55d9230df07496cd8ef75de7741c94c0a726c08c
-
SHA512
705e9711cb15f29d2e1aceb02b00160f2ff14f8c87735948f022dce34416f0ee1902d20663640a800d67b4abcb410d25f48e627a3df4722b7c40b6905b8b3e27
-
SSDEEP
1536:zP8g2CSJG5mIOd34g1Ab0Y1jAFrZ4V/3ETVO5bTa6MFjpChUDDl0+wywVFN+S4d5:z0FGE14V1jI45ERO5bTKhpCyevQW
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 679 377ff63aed8929367fe0634b55d9230df07496cd8ef75de7741c94c0a726c08c.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/678/cmdline File opened for reading /proc/748/cmdline File opened for reading /proc/761/cmdline File opened for reading /proc/782/cmdline File opened for reading /proc/108/cmdline File opened for reading /proc/653/cmdline File opened for reading /proc/681/cmdline File opened for reading /proc/705/cmdline File opened for reading /proc/775/cmdline File opened for reading /proc/654/cmdline File opened for reading /proc/696/cmdline File opened for reading /proc/721/cmdline File opened for reading /proc/728/cmdline File opened for reading /proc/737/cmdline File opened for reading /proc/764/cmdline File opened for reading /proc/777/cmdline File opened for reading /proc/794/cmdline File opened for reading /proc/25/cmdline File opened for reading /proc/43/cmdline File opened for reading /proc/716/cmdline File opened for reading /proc/729/cmdline File opened for reading /proc/780/cmdline File opened for reading /proc/19/cmdline File opened for reading /proc/21/cmdline File opened for reading /proc/692/cmdline File opened for reading /proc/779/cmdline File opened for reading /proc/763/cmdline File opened for reading /proc/766/cmdline File opened for reading /proc/27/cmdline File opened for reading /proc/28/cmdline File opened for reading /proc/659/cmdline File opened for reading /proc/741/cmdline File opened for reading /proc/739/cmdline File opened for reading /proc/745/cmdline File opened for reading /proc/772/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/111/cmdline File opened for reading /proc/711/cmdline File opened for reading /proc/725/cmdline File opened for reading /proc/712/cmdline File opened for reading /proc/717/cmdline File opened for reading /proc/738/cmdline File opened for reading /proc/657/cmdline File opened for reading /proc/707/cmdline File opened for reading /proc/720/cmdline File opened for reading /proc/788/cmdline File opened for reading /proc/690/cmdline File opened for reading /proc/722/cmdline File opened for reading /proc/731/cmdline File opened for reading /proc/751/cmdline File opened for reading /proc/706/cmdline File opened for reading /proc/710/cmdline File opened for reading /proc/719/cmdline File opened for reading /proc/730/cmdline File opened for reading /proc/13/cmdline File opened for reading /proc/23/cmdline File opened for reading /proc/687/cmdline File opened for reading /proc/689/cmdline File opened for reading /proc/765/cmdline File opened for reading /proc/701/cmdline File opened for reading /proc/746/cmdline File opened for reading /proc/756/cmdline File opened for reading /proc/17/cmdline File opened for reading /proc/682/cmdline