Analysis
-
max time kernel
153s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20231215-en -
resource tags
arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
18-02-2024 02:32
Behavioral task
behavioral1
Sample
51dd0aac50ac26998594dcec830da6a4f3b017c7a04b1b4c1dcfc3d15f9d6c73.elf
Resource
debian9-armhf-20231215-en
General
-
Target
51dd0aac50ac26998594dcec830da6a4f3b017c7a04b1b4c1dcfc3d15f9d6c73.elf
-
Size
138KB
-
MD5
668364ed33c09d7c252568344c4b413e
-
SHA1
4996307c7e1b70d3ae4124f7265b1a15561a6bde
-
SHA256
51dd0aac50ac26998594dcec830da6a4f3b017c7a04b1b4c1dcfc3d15f9d6c73
-
SHA512
6ebe3fefb7622ad19b1d1e6699dd6848e4ecd0c30587ca72b01f0f7b3fded70d47348229fce9943b23bfce45955c1ec14c9d2c6c467e74449c2096144f9698b6
-
SSDEEP
1536:o6sYiS5hDkW3wUjrk9tAT2Qt6aGFfA8ML44VsNk+TnzB3k1BwAWOtR7l9sGwywL6:o60WW/PhFfl485rzB3kdtthKlbVtg
Malware Config
Signatures
-
Changes its process name 1 IoCs
Processes:
51dd0aac50ac26998594dcec830da6a4f3b017c7a04b1b4c1dcfc3d15f9d6c73.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself a- M"! 675 51dd0aac50ac26998594dcec830da6a4f3b017c7a04b1b4c1dcfc3d15f9d6c73.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/116/cmdline File opened for reading /proc/283/cmdline File opened for reading /proc/730/cmdline File opened for reading /proc/737/cmdline File opened for reading /proc/767/cmdline File opened for reading /proc/756/cmdline File opened for reading /proc/24/cmdline File opened for reading /proc/83/cmdline File opened for reading /proc/281/cmdline File opened for reading /proc/688/cmdline File opened for reading /proc/715/cmdline File opened for reading /proc/28/cmdline File opened for reading /proc/671/cmdline File opened for reading /proc/705/cmdline File opened for reading /proc/776/cmdline File opened for reading /proc/653/cmdline File opened for reading /proc/659/cmdline File opened for reading /proc/697/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/16/cmdline File opened for reading /proc/21/cmdline File opened for reading /proc/29/cmdline File opened for reading /proc/650/cmdline File opened for reading /proc/732/cmdline File opened for reading /proc/753/cmdline File opened for reading /proc/786/cmdline File opened for reading /proc/741/cmdline File opened for reading /proc/768/cmdline File opened for reading /proc/770/cmdline File opened for reading /proc/4/cmdline File opened for reading /proc/5/cmdline File opened for reading /proc/534/cmdline File opened for reading /proc/699/cmdline File opened for reading /proc/708/cmdline File opened for reading /proc/759/cmdline File opened for reading /proc/771/cmdline File opened for reading /proc/7/cmdline File opened for reading /proc/18/cmdline File opened for reading /proc/486/cmdline File opened for reading /proc/676/cmdline File opened for reading /proc/677/cmdline File opened for reading /proc/10/cmdline File opened for reading /proc/42/cmdline File opened for reading /proc/325/cmdline File opened for reading /proc/713/cmdline File opened for reading /proc/763/cmdline File opened for reading /proc/695/cmdline File opened for reading /proc/718/cmdline File opened for reading /proc/750/cmdline File opened for reading /proc/761/cmdline File opened for reading /proc/8/cmdline File opened for reading /proc/146/cmdline File opened for reading /proc/649/cmdline File opened for reading /proc/706/cmdline File opened for reading /proc/712/cmdline File opened for reading /proc/783/cmdline File opened for reading /proc/789/cmdline File opened for reading /proc/12/cmdline File opened for reading /proc/731/cmdline File opened for reading /proc/679/cmdline File opened for reading /proc/721/cmdline File opened for reading /proc/772/cmdline File opened for reading /proc/760/cmdline File opened for reading /proc/774/cmdline