b9465095c23174384f8771fca52412211d772b0ac9d7296f63bde5eafa8231e4

Analysis

max time kernel
149s
max time network
145s
platform
debian-9_armhf
resource
debian9-armhf-20240226-en
resource tags

arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04-04-2024 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fb02367c32a37d5291da9e73aaedabc.elf
Size

157KB
MD5

2fb02367c32a37d5291da9e73aaedabc
SHA1

4e9091168840bc7ab7895cea6a618635f3933b59
SHA256

b9465095c23174384f8771fca52412211d772b0ac9d7296f63bde5eafa8231e4
SHA512

0fe70483f14b4c94128c35283b206e5c48bda8778f80197e69b5554973d3e75132a5fc89af3638b36cafc863c1d66ce86cfe03f772eadf923c744edfaf833b99
SSDEEP

3072:2IW4XBzIaeG9/zaTKQSnebTFoCNI4yOA3W4TAM/9jsgTwb:2IxXVNeG9zaTKQSebiCC3F3W40M/9Ag4

Score

7^/10

Malware Config

Signatures

Changes its process name 1 IoCs

Processes:

2fb02367c32a37d5291da9e73aaedabc.elf

description ioc pid process

Changes the process name, possibly in an attempt to hide itself a 636 2fb02367c32a37d5291da9e73aaedabc.elf
Enumerates running processes
Discovers information about currently running processes on the system

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	a	636	2fb02367c32a37d5291da9e73aaedabc.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
File opened for reading	/proc/12/cmdline
File opened for reading	/proc/133/cmdline
File opened for reading	/proc/628/cmdline
File opened for reading	/proc/17/cmdline
File opened for reading	/proc/23/cmdline
File opened for reading	/proc/267/cmdline
File opened for reading	/proc/654/cmdline
File opened for reading	/proc/660/cmdline
File opened for reading	/proc/688/cmdline
File opened for reading	/proc/689/cmdline
File opened for reading	/proc/312/cmdline
File opened for reading	/proc/641/cmdline
File opened for reading	/proc/644/cmdline
File opened for reading	/proc/649/cmdline
File opened for reading	/proc/678/cmdline
File opened for reading	/proc/1/maps
File opened for reading	/proc/27/cmdline
File opened for reading	/proc/106/cmdline
File opened for reading	/proc/213/cmdline
File opened for reading	/proc/590/cmdline
File opened for reading	/proc/643/cmdline
File opened for reading	/proc/684/cmdline
File opened for reading	/proc/28/cmdline
File opened for reading	/proc/144/cmdline
File opened for reading	/proc/631/cmdline
File opened for reading	/proc/674/cmdline
File opened for reading	/proc/697/cmdline
File opened for reading	/proc/15/cmdline
File opened for reading	/proc/19/cmdline
File opened for reading	/proc/570/cmdline
File opened for reading	/proc/640/cmdline
File opened for reading	/proc/700/cmdline
File opened for reading	/proc/43/cmdline
File opened for reading	/proc/74/cmdline
File opened for reading	/proc/668/cmdline
File opened for reading	/proc/706/cmdline
File opened for reading	/proc/659/cmdline
File opened for reading	/proc/699/cmdline
File opened for reading	/proc/702/cmdline
File opened for reading	/proc/2/cmdline
File opened for reading	/proc/14/cmdline
File opened for reading	/proc/21/cmdline
File opened for reading	/proc/651/cmdline
File opened for reading	/proc/652/cmdline
File opened for reading	/proc/663/cmdline
File opened for reading	/proc/704/cmdline
File opened for reading	/proc/18/cmdline
File opened for reading	/proc/20/cmdline
File opened for reading	/proc/657/cmdline
File opened for reading	/proc/664/cmdline
File opened for reading	/proc/13/cmdline
File opened for reading	/proc/147/cmdline
File opened for reading	/proc/286/cmdline
File opened for reading	/proc/303/cmdline
File opened for reading	/proc/634/cmdline
File opened for reading	/proc/1/cmdline
File opened for reading	/proc/655/cmdline
File opened for reading	/proc/680/cmdline
File opened for reading	/proc/695/cmdline
File opened for reading	/proc/10/cmdline
File opened for reading	/proc/135/cmdline
File opened for reading	/proc/648/cmdline
File opened for reading	/proc/622/cmdline
File opened for reading	/proc/677/cmdline

/tmp/2fb02367c32a37d5291da9e73aaedabc.elf
/tmp/2fb02367c32a37d5291da9e73aaedabc.elf
1⤵
- Changes its process name
PID:636

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads