Analysis
-
max time kernel
151s -
max time network
150s -
platform
debian-9_armhf -
resource
debian9-armhf-20231221-en -
resource tags
arch:armhfimage:debian9-armhf-20231221-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
12-02-2024 04:59
Behavioral task
behavioral1
Sample
b5c8bcfab39ff142b860bcc08b0951e6a080b051554666e1509fe8fce25161fc.elf
Resource
debian9-armhf-20231221-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
b5c8bcfab39ff142b860bcc08b0951e6a080b051554666e1509fe8fce25161fc.elf
-
Size
114KB
-
MD5
f30cc59c770c68a4e1717d493a777c6f
-
SHA1
1ce4e1e80c735b59502b0e4d853b617f40738516
-
SHA256
b5c8bcfab39ff142b860bcc08b0951e6a080b051554666e1509fe8fce25161fc
-
SHA512
6e55d3d10447db28b41b36918ed0545fd4d75c3165c3fcc536d17dd32656f45fb941a58ec7ab0195c29df33e06b62d3685287eb82de6dc0fcb984092d9a7eb39
-
SSDEEP
1536:ZhNOKLDdTHan1/AxPG4VamYT8rhhZM5c6qNftZxl8zwywLFOK3HbWHiJWGOJzU:ZhrhLw1/345Y4rhhZmqNVBkU
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 659 b5c8bcfab39ff142b860bcc08b0951e6a080b051554666e1509fe8fce25161fc.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/27/cmdline File opened for reading /proc/28/cmdline File opened for reading /proc/143/cmdline File opened for reading /proc/209/cmdline File opened for reading /proc/645/cmdline File opened for reading /proc/737/cmdline File opened for reading /proc/15/cmdline File opened for reading /proc/18/cmdline File opened for reading /proc/751/cmdline File opened for reading /proc/141/cmdline File opened for reading /proc/696/cmdline File opened for reading /proc/757/cmdline File opened for reading /proc/41/cmdline File opened for reading /proc/80/cmdline File opened for reading /proc/681/cmdline File opened for reading /proc/698/cmdline File opened for reading /proc/759/cmdline File opened for reading /proc/5/cmdline File opened for reading /proc/110/cmdline File opened for reading /proc/583/cmdline File opened for reading /proc/728/cmdline File opened for reading /proc/769/cmdline File opened for reading /proc/9/cmdline File opened for reading /proc/272/cmdline File opened for reading /proc/668/cmdline File opened for reading /proc/726/cmdline File opened for reading /proc/1/cmdline File opened for reading /proc/24/cmdline File opened for reading /proc/23/cmdline File opened for reading /proc/25/cmdline File opened for reading /proc/661/cmdline File opened for reading /proc/712/cmdline File opened for reading /proc/760/cmdline File opened for reading /proc/4/cmdline File opened for reading /proc/7/cmdline File opened for reading /proc/578/cmdline File opened for reading /proc/705/cmdline File opened for reading /proc/706/cmdline File opened for reading /proc/774/cmdline File opened for reading /proc/20/cmdline File opened for reading /proc/275/cmdline File opened for reading /proc/684/cmdline File opened for reading /proc/734/cmdline File opened for reading /proc/758/cmdline File opened for reading /proc/42/cmdline File opened for reading /proc/311/cmdline File opened for reading /proc/173/cmdline File opened for reading /proc/308/cmdline File opened for reading /proc/704/cmdline File opened for reading /proc/732/cmdline File opened for reading /proc/747/cmdline File opened for reading /proc/756/cmdline File opened for reading /proc/11/cmdline File opened for reading /proc/112/cmdline File opened for reading /proc/762/cmdline File opened for reading /proc/673/cmdline File opened for reading /proc/716/cmdline File opened for reading /proc/720/cmdline File opened for reading /proc/777/cmdline File opened for reading /proc/660/cmdline File opened for reading /proc/672/cmdline File opened for reading /proc/667/cmdline File opened for reading /proc/691/cmdline File opened for reading /proc/642/cmdline