Analysis
-
max time kernel
149s -
max time network
155s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
12-02-2024 03:22
Behavioral task
behavioral1
Sample
73e0488bf18996062aaa4e4f3fd31ac2c8761663a3f1a30b331b180abb3cd6b6.elf
Resource
debian9-armhf-20231215-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
73e0488bf18996062aaa4e4f3fd31ac2c8761663a3f1a30b331b180abb3cd6b6.elf
-
Size
176KB
-
MD5
d7d938d80ef9556ca4ed91f9c11e8565
-
SHA1
be9917e6e766c80e8edcb2df9928c23f9c11ed86
-
SHA256
73e0488bf18996062aaa4e4f3fd31ac2c8761663a3f1a30b331b180abb3cd6b6
-
SHA512
b99cf1d43c1c3f202953b8b5ddc4a50a1525c815fe6d087e80c535b0f233415c152e3b3a792ef840fd4e0a1902ef66b11bcccaec796efd786b5c289145bbaa9f
-
SSDEEP
3072:lfm9wBnwyiKj6Xa1AQimt2NnvmA5gGzC+XPSorM/RTfmpFA:lfZnwB24a1AQimtkOAOGzC+fTrM/Rq+
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself 650 73e0488bf18996062aaa4e4f3fd31ac2c8761663a3f1a30b331b180abb3cd6b6.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/743/status File opened for reading /proc/9/status File opened for reading /proc/11/status File opened for reading /proc/263/status File opened for reading /proc/575/status File opened for reading /proc/753/status File opened for reading /proc/755/status File opened for reading /proc/14/status File opened for reading /proc/27/status File opened for reading /proc/108/status File opened for reading /proc/302/status File opened for reading /proc/41/status File opened for reading /proc/588/status File opened for reading /proc/8/status File opened for reading /proc/654/status File opened for reading /proc/771/status File opened for reading /proc/20/status File opened for reading /proc/22/status File opened for reading /proc/143/status File opened for reading /proc/627/status File opened for reading /proc/15/status File opened for reading /proc/25/status File opened for reading /proc/148/status File opened for reading /proc/651/status File opened for reading /proc/763/status File opened for reading /proc/18/status File opened for reading /proc/165/status File opened for reading /proc/261/status File opened for reading /proc/336/status File opened for reading /proc/7/status File opened for reading /proc/19/status File opened for reading /proc/28/status File opened for reading /proc/757/status File opened for reading /proc/656/status File opened for reading /proc/765/status File opened for reading /proc/770/status File opened for reading /proc/777/status File opened for reading /proc/6/status File opened for reading /proc/631/status File opened for reading /proc/633/status File opened for reading /proc/637/status File opened for reading /proc/10/status File opened for reading /proc/105/status File opened for reading /proc/107/status File opened for reading /proc/653/status File opened for reading /proc/96/status File opened for reading /proc/136/status File opened for reading /proc/264/status File opened for reading /proc/634/status File opened for reading /proc/2/status File opened for reading /proc/5/status File opened for reading /proc/42/status File opened for reading /proc/75/status File opened for reading /proc/652/status File opened for reading /proc/758/status File opened for reading /proc/762/status File opened for reading /proc/754/status File opened for reading /proc/776/status File opened for reading /proc/17/status File opened for reading /proc/262/status File opened for reading /proc/267/status File opened for reading /proc/574/status File opened for reading /proc/12/status File opened for reading /proc/23/status