b9465095c23174384f8771fca52412211d772b0ac9d7296f63bde5eafa8231e4

Analysis

max time kernel
149s
max time network
144s
platform
debian-9_armhf
resource
debian9-armhf-20240226-en
resource tags

arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
05-04-2024 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9465095c23174384f8771fca52412211d772b0ac9d7296f63bde5eafa8231e4.elf
Size

157KB
MD5

2fb02367c32a37d5291da9e73aaedabc
SHA1

4e9091168840bc7ab7895cea6a618635f3933b59
SHA256

b9465095c23174384f8771fca52412211d772b0ac9d7296f63bde5eafa8231e4
SHA512

0fe70483f14b4c94128c35283b206e5c48bda8778f80197e69b5554973d3e75132a5fc89af3638b36cafc863c1d66ce86cfe03f772eadf923c744edfaf833b99
SSDEEP

3072:2IW4XBzIaeG9/zaTKQSnebTFoCNI4yOA3W4TAM/9jsgTwb:2IxXVNeG9zaTKQSebiCC3F3W40M/9Ag4

Score

7^/10

Malware Config

Signatures

Changes its process name 1 IoCs

Processes:

b9465095c23174384f8771fca52412211d772b0ac9d7296f63bde5eafa8231e4.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	a	647	b9465095c23174384f8771fca52412211d772b0ac9d7296f63bde5eafa8231e4.elf

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
File opened for reading	/proc/709/cmdline
File opened for reading	/proc/598/cmdline
File opened for reading	/proc/648/cmdline
File opened for reading	/proc/270/cmdline
File opened for reading	/proc/652/cmdline
File opened for reading	/proc/271/cmdline
File opened for reading	/proc/667/cmdline
File opened for reading	/proc/681/cmdline
File opened for reading	/proc/10/cmdline
File opened for reading	/proc/41/cmdline
File opened for reading	/proc/112/cmdline
File opened for reading	/proc/306/cmdline
File opened for reading	/proc/656/cmdline
File opened for reading	/proc/1/cmdline
File opened for reading	/proc/27/cmdline
File opened for reading	/proc/701/cmdline
File opened for reading	/proc/20/cmdline
File opened for reading	/proc/25/cmdline
File opened for reading	/proc/19/cmdline
File opened for reading	/proc/653/cmdline
File opened for reading	/proc/664/cmdline
File opened for reading	/proc/704/cmdline
File opened for reading	/proc/170/cmdline
File opened for reading	/proc/660/cmdline
File opened for reading	/proc/706/cmdline
File opened for reading	/proc/711/cmdline
File opened for reading	/proc/715/cmdline
File opened for reading	/proc/682/cmdline
File opened for reading	/proc/684/cmdline
File opened for reading	/proc/680/cmdline
File opened for reading	/proc/23/cmdline
File opened for reading	/proc/43/cmdline
File opened for reading	/proc/172/cmdline
File opened for reading	/proc/719/cmdline
File opened for reading	/proc/6/cmdline
File opened for reading	/proc/691/cmdline
File opened for reading	/proc/320/cmdline
File opened for reading	/proc/21/cmdline
File opened for reading	/proc/26/cmdline
File opened for reading	/proc/3/cmdline
File opened for reading	/proc/28/cmdline
File opened for reading	/proc/220/cmdline
File opened for reading	/proc/601/cmdline
File opened for reading	/proc/670/cmdline
File opened for reading	/proc/714/cmdline
File opened for reading	/proc/1/maps
File opened for reading	/proc/639/cmdline
File opened for reading	/proc/602/cmdline
File opened for reading	/proc/678/cmdline
File opened for reading	/proc/145/cmdline
File opened for reading	/proc/666/cmdline
File opened for reading	/proc/697/cmdline
File opened for reading	/proc/707/cmdline
File opened for reading	/proc/13/cmdline
File opened for reading	/proc/15/cmdline
File opened for reading	/proc/276/cmdline
File opened for reading	/proc/640/cmdline
File opened for reading	/proc/672/cmdline
File opened for reading	/proc/717/cmdline
File opened for reading	/proc/143/cmdline
File opened for reading	/proc/153/cmdline
File opened for reading	/proc/655/cmdline
File opened for reading	/proc/698/cmdline
File opened for reading	/proc/712/cmdline

/tmp/b9465095c23174384f8771fca52412211d772b0ac9d7296f63bde5eafa8231e4.elf
/tmp/b9465095c23174384f8771fca52412211d772b0ac9d7296f63bde5eafa8231e4.elf
1⤵
- Changes its process name
PID:647

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads