Analysis
-
max time kernel
151s -
max time network
158s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
07/03/2024, 02:15
Behavioral task
behavioral1
Sample
4185b72ad60bd5f4f7dda7101edddc86a1a2ac0192e3975562857705ec7b3943.elf
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
5 signatures
150 seconds
General
-
Target
4185b72ad60bd5f4f7dda7101edddc86a1a2ac0192e3975562857705ec7b3943.elf
-
Size
181KB
-
MD5
30f976baa2d03734e6ca5c993f02cd49
-
SHA1
0a9826d321f599708ec3d8150fba7cda94026a5c
-
SHA256
4185b72ad60bd5f4f7dda7101edddc86a1a2ac0192e3975562857705ec7b3943
-
SHA512
c1f3cc296102c97a4eff838fba94ca4271b65609fee22d579b0a06a5cfed287aeee24507d85300fcfc88ecbdc952184847c44d3fdc8518540fedc50734caf437
-
SSDEEP
3072:FoM0KKCD2XQ0AcrlBLwVW3CmRx9X6hHRyCcaolZj:qM0bDQ0zBLwVWCm3R8VpE
Score
9/10
Malware Config
Signatures
-
Contacts a large (152743) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M 8 724 4185b72ad60bd5f4f7dda7101edddc86a1a2ac0192e3975562857705ec7b3943.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/113/cmdline File opened for reading /proc/118/cmdline File opened for reading /proc/190/cmdline File opened for reading /proc/412/cmdline File opened for reading /proc/689/cmdline File opened for reading /proc/740/cmdline File opened for reading /proc/757/cmdline File opened for reading /proc/112/cmdline File opened for reading /proc/394/cmdline File opened for reading /proc/717/cmdline File opened for reading /proc/750/cmdline File opened for reading /proc/751/cmdline File opened for reading /proc/770/cmdline File opened for reading /proc/5/cmdline File opened for reading /proc/731/cmdline File opened for reading /proc/758/cmdline File opened for reading /proc/1/cmdline File opened for reading /proc/3/cmdline File opened for reading /proc/33/cmdline File opened for reading /proc/775/cmdline File opened for reading /proc/778/cmdline File opened for reading /proc/727/cmdline File opened for reading /proc/4/cmdline File opened for reading /proc/27/cmdline File opened for reading /proc/730/cmdline File opened for reading /proc/749/cmdline File opened for reading /proc/784/cmdline File opened for reading /proc/202/cmdline File opened for reading /proc/766/cmdline File opened for reading /proc/7/cmdline File opened for reading /proc/28/cmdline File opened for reading /proc/32/cmdline File opened for reading /proc/431/cmdline File opened for reading /proc/711/cmdline File opened for reading /proc/721/cmdline File opened for reading /proc/733/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/47/cmdline File opened for reading /proc/768/cmdline File opened for reading /proc/779/cmdline File opened for reading /proc/13/cmdline File opened for reading /proc/381/cmdline File opened for reading /proc/738/cmdline File opened for reading /proc/756/cmdline File opened for reading /proc/780/cmdline File opened for reading /proc/786/cmdline File opened for reading /proc/21/cmdline File opened for reading /proc/22/cmdline File opened for reading /proc/2/cmdline File opened for reading /proc/111/cmdline File opened for reading /proc/137/cmdline File opened for reading /proc/691/cmdline File opened for reading /proc/6/cmdline File opened for reading /proc/8/cmdline File opened for reading /proc/15/cmdline File opened for reading /proc/18/cmdline File opened for reading /proc/23/cmdline File opened for reading /proc/35/cmdline File opened for reading /proc/323/cmdline File opened for reading /proc/716/cmdline File opened for reading /proc/771/cmdline File opened for reading /proc/10/cmdline File opened for reading /proc/19/cmdline File opened for reading /proc/45/cmdline