Analysis
-
max time kernel
150s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
06/03/2024, 09:03
Behavioral task
behavioral1
Sample
b70a3e0a007a775b4bb39f951e43ce0b094512e7cf3205e7d4bb40e5c3a6275b
Resource
debian9-armhf-20240226-en
debian-9-armhf
5 signatures
150 seconds
General
-
Target
b70a3e0a007a775b4bb39f951e43ce0b094512e7cf3205e7d4bb40e5c3a6275b
-
Size
142KB
-
MD5
47d07e0e11c935e691b66565b3325cb5
-
SHA1
cae2f1b1c9a82dc81c5effe5b25a5c1c671f6349
-
SHA256
b70a3e0a007a775b4bb39f951e43ce0b094512e7cf3205e7d4bb40e5c3a6275b
-
SHA512
03e6e12923b94779865845b4467823eb9d5bfc217773cb90b6635ea329d20d5d8036f1e7dd43e581eff1f4f529bf114d1debe24602c37b9e73a3f6ac8cc25426
-
SSDEEP
3072:Dc+MKM8doPOpwc11ei4QkzTpxbNLiYT5UalRH9ZZ:Dc58PBXei4QKTrbJUalRdZZ
Score
9/10
Malware Config
Signatures
-
Contacts a large (46370) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself _@ 664 b70a3e0a007a775b4bb39f951e43ce0b094512e7cf3205e7d4bb40e5c3a6275b -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/803/cmdline File opened for reading /proc/12/status File opened for reading /proc/42/status File opened for reading /proc/144/status File opened for reading /proc/620/status File opened for reading /proc/irq/cmdline File opened for reading /proc/787/cmdline File opened for reading /proc/800/status File opened for reading /proc/28/status File opened for reading /proc/109/status File opened for reading /proc/458/cmdline File opened for reading /proc/149/status File opened for reading /proc/420/status File opened for reading /proc/111/cmdline File opened for reading /proc/273/cmdline File opened for reading /proc/420/cmdline File opened for reading /proc/808/status File opened for reading /proc/18/status File opened for reading /proc/21/status File opened for reading /proc/305/status File opened for reading /proc/663/cmdline File opened for reading /proc/658/cmdline File opened for reading /proc/803/status File opened for reading /proc/675/cmdline File opened for reading /proc/111/status File opened for reading /proc/663/status File opened for reading /proc/16/cmdline File opened for reading /proc/28/cmdline File opened for reading /proc/42/cmdline File opened for reading /proc/668/cmdline File opened for reading /proc/671/cmdline File opened for reading /proc/671/status File opened for reading /proc/781/status File opened for reading /proc/17/status File opened for reading /proc/279/status File opened for reading /proc/4/cmdline File opened for reading /proc/760/cmdline File opened for reading /proc/807/status File opened for reading /proc/305/cmdline File opened for reading /proc/662/status File opened for reading /proc/666/status File opened for reading /proc/tty/cmdline File opened for reading /proc/109/cmdline File opened for reading /proc/149/cmdline File opened for reading /proc/152/cmdline File opened for reading /proc/278/cmdline File opened for reading /proc/695/cmdline File opened for reading /proc/791/status File opened for reading /proc/6/status File opened for reading /proc/29/cmdline File opened for reading /proc/314/cmdline File opened for reading /proc/799/status File opened for reading /proc/808/cmdline File opened for reading /proc/277/status File opened for reading /proc/bus/cmdline File opened for reading /proc/driver/cmdline File opened for reading /proc/20/cmdline File opened for reading /proc/620/cmdline File opened for reading /proc/792/status File opened for reading /proc/795/status File opened for reading /proc/152/status File opened for reading /proc/275/status File opened for reading /proc/314/status File opened for reading /proc/sys/cmdline