Analysis
-
max time kernel
152s -
max time network
155s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
13/02/2024, 04:25
Static task
static1
Behavioral task
behavioral1
Sample
a438ffa52454de2ce0a22733fbfd0fc8b66d66a1eb0eb3ff92d96996c579f9be.elf
Resource
debian9-armhf-20231215-en
debian-9-armhf
General
-
Target
a438ffa52454de2ce0a22733fbfd0fc8b66d66a1eb0eb3ff92d96996c579f9be.elf
-
Size
124KB
-
MD5
bb35602fdbd2badaa06a0bad513ed9d5
-
SHA1
d1d1a6a608a4352eb1c29091529645db9626a16f
-
SHA256
a438ffa52454de2ce0a22733fbfd0fc8b66d66a1eb0eb3ff92d96996c579f9be
-
SHA512
5fa24a862cd3d029bcc128d83aacc57388d128832c7d3d7eaed1ebf0562aa45c94a8d38ece4e46a03fd038ead5c0a7043e4a905c82b4accf6dc660ff2c9745b9
-
SSDEEP
3072:Iz1XP86P63qV70zS19FV37IzMbOYpM/9+pg:op86P4OQzS19FV79bOeM/9+pg
Malware Config
Signatures
-
Contacts a large (43662) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/640/maps File opened for reading /proc/892/exe File opened for reading /proc/896/exe File opened for reading /proc/914/exe File opened for reading /proc/577/maps File opened for reading /proc/637/exe File opened for reading /proc/685/exe File opened for reading /proc/824/exe File opened for reading /proc/910/exe File opened for reading /proc/6/maps File opened for reading /proc/10/maps File opened for reading /proc/675/maps File opened for reading /proc/778/exe File opened for reading /proc/856/exe File opened for reading /proc/874/maps File opened for reading /proc/25/exe File opened for reading /proc/635/maps File opened for reading /proc/3/exe File opened for reading /proc/628/maps File opened for reading /proc/663/maps File opened for reading /proc/41/exe File opened for reading /proc/842/maps File opened for reading /proc/12/exe File opened for reading /proc/7/maps File opened for reading /proc/14/maps File opened for reading /proc/731/exe File opened for reading /proc/22/exe File opened for reading /proc/26/maps File opened for reading /proc/143/maps File opened for reading /proc/276/maps File opened for reading /proc/720/maps File opened for reading /proc/920/maps File opened for reading /proc/685/maps File opened for reading /proc/875/exe File opened for reading /proc/658/exe File opened for reading /proc/661/maps File opened for reading /proc/910/maps File opened for reading /proc/914/maps File opened for reading /proc/15/exe File opened for reading /proc/172/maps File opened for reading /proc/704/maps File opened for reading /proc/730/maps File opened for reading /proc/814/maps File opened for reading /proc/856/maps File opened for reading /proc/833/maps File opened for reading /proc/886/exe File opened for reading /proc/906/maps File opened for reading /proc/847/maps File opened for reading /proc/820/maps File opened for reading /proc/731/maps File opened for reading /proc/866/exe File opened for reading /proc/2/exe File opened for reading /proc/13/exe File opened for reading /proc/43/exe File opened for reading /proc/782/maps File opened for reading /proc/766/maps File opened for reading /proc/883/exe File opened for reading /proc/924/exe File opened for reading /proc/11/maps File opened for reading /proc/277/maps File opened for reading /proc/658/maps File opened for reading /proc/896/maps File opened for reading /proc/661/exe File opened for reading /proc/692/maps