Analysis
-
max time kernel
150s -
max time network
152s -
platform
debian-9_armhf -
resource
debian9-armhf-20231222-en -
resource tags
arch:armhfimage:debian9-armhf-20231222-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
16-02-2024 12:42
Behavioral task
behavioral1
Sample
668364ed33c09d7c252568344c4b413e.elf
Resource
debian9-armhf-20231222-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
668364ed33c09d7c252568344c4b413e.elf
-
Size
138KB
-
MD5
668364ed33c09d7c252568344c4b413e
-
SHA1
4996307c7e1b70d3ae4124f7265b1a15561a6bde
-
SHA256
51dd0aac50ac26998594dcec830da6a4f3b017c7a04b1b4c1dcfc3d15f9d6c73
-
SHA512
6ebe3fefb7622ad19b1d1e6699dd6848e4ecd0c30587ca72b01f0f7b3fded70d47348229fce9943b23bfce45955c1ec14c9d2c6c467e74449c2096144f9698b6
-
SSDEEP
1536:o6sYiS5hDkW3wUjrk9tAT2Qt6aGFfA8ML44VsNk+TnzB3k1BwAWOtR7l9sGwywL6:o60WW/PhFfl485rzB3kdtthKlbVtg
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
Processes:
668364ed33c09d7c252568344c4b413e.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself a- M"! 657 668364ed33c09d7c252568344c4b413e.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/3/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/25/cmdline File opened for reading /proc/150/cmdline File opened for reading /proc/258/cmdline File opened for reading /proc/305/cmdline File opened for reading /proc/668/cmdline File opened for reading /proc/674/cmdline File opened for reading /proc/727/cmdline File opened for reading /proc/754/cmdline File opened for reading /proc/757/cmdline File opened for reading /proc/570/cmdline File opened for reading /proc/675/cmdline File opened for reading /proc/704/cmdline File opened for reading /proc/746/cmdline File opened for reading /proc/26/cmdline File opened for reading /proc/297/cmdline File opened for reading /proc/683/cmdline File opened for reading /proc/773/cmdline File opened for reading /proc/106/cmdline File opened for reading /proc/109/cmdline File opened for reading /proc/309/cmdline File opened for reading /proc/701/cmdline File opened for reading /proc/714/cmdline File opened for reading /proc/729/cmdline File opened for reading /proc/760/cmdline File opened for reading /proc/769/cmdline File opened for reading /proc/707/cmdline File opened for reading /proc/732/cmdline File opened for reading /proc/5/cmdline File opened for reading /proc/43/cmdline File opened for reading /proc/76/cmdline File opened for reading /proc/169/cmdline File opened for reading /proc/666/cmdline File opened for reading /proc/684/cmdline File opened for reading /proc/697/cmdline File opened for reading /proc/723/cmdline File opened for reading /proc/725/cmdline File opened for reading /proc/731/cmdline File opened for reading /proc/758/cmdline File opened for reading /proc/10/cmdline File opened for reading /proc/41/cmdline File opened for reading /proc/667/cmdline File opened for reading /proc/745/cmdline File opened for reading /proc/748/cmdline File opened for reading /proc/770/cmdline File opened for reading /proc/680/cmdline File opened for reading /proc/715/cmdline File opened for reading /proc/737/cmdline File opened for reading /proc/740/cmdline File opened for reading /proc/134/cmdline File opened for reading /proc/658/cmdline File opened for reading /proc/686/cmdline File opened for reading /proc/693/cmdline File opened for reading /proc/713/cmdline File opened for reading /proc/1/cmdline File opened for reading /proc/12/cmdline File opened for reading /proc/739/cmdline File opened for reading /proc/759/cmdline File opened for reading /proc/4/cmdline File opened for reading /proc/9/cmdline File opened for reading /proc/17/cmdline File opened for reading /proc/264/cmdline File opened for reading /proc/676/cmdline