Analysis
-
max time kernel
149s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
19/04/2024, 02:13
Behavioral task
behavioral1
Sample
f7f1973f6160bb4251ea95ebd1c3a5e6ef39c28a1a98e40aef7542b4daeb80a0.elf
Resource
debian9-armhf-20240226-en
3 signatures
150 seconds
General
-
Target
f7f1973f6160bb4251ea95ebd1c3a5e6ef39c28a1a98e40aef7542b4daeb80a0.elf
-
Size
175KB
-
MD5
f4a2e178b2b5b6a5deb1d6c76de0a49b
-
SHA1
7d5826f9f1e4da77dc3130b1dd3c52fe9895236f
-
SHA256
f7f1973f6160bb4251ea95ebd1c3a5e6ef39c28a1a98e40aef7542b4daeb80a0
-
SHA512
7358770b367c587883f49c9bd4d083b1c4702fef2eb8d01177d41058f325fb87330972720f5d654c773e905a6f4e05e631184dcc85d8ae162c136c5c15ab9566
-
SSDEEP
3072:EZHZ1pjx3vAqTkgabsh+OcAIeLHSwBjvq2cJsoyM/Rs+qtK:EZ5Hx39ogabsh+nAFlBjq2+xyM/R7qK
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself -"6 664 f7f1973f6160bb4251ea95ebd1c3a5e6ef39c28a1a98e40aef7542b4daeb80a0.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/13/cmdline File opened for reading /proc/279/cmdline File opened for reading /proc/660/cmdline File opened for reading /proc/692/cmdline File opened for reading /proc/730/cmdline File opened for reading /proc/766/cmdline File opened for reading /proc/773/cmdline File opened for reading /proc/9/cmdline File opened for reading /proc/24/cmdline File opened for reading /proc/676/cmdline File opened for reading /proc/678/cmdline File opened for reading /proc/723/cmdline File opened for reading /proc/748/cmdline File opened for reading /proc/775/cmdline File opened for reading /proc/682/cmdline File opened for reading /proc/687/cmdline File opened for reading /proc/711/cmdline File opened for reading /proc/714/cmdline File opened for reading /proc/735/cmdline File opened for reading /proc/738/cmdline File opened for reading /proc/752/cmdline File opened for reading /proc/774/cmdline File opened for reading /proc/785/cmdline File opened for reading /proc/313/cmdline File opened for reading /proc/708/cmdline File opened for reading /proc/755/cmdline File opened for reading /proc/771/cmdline File opened for reading /proc/41/cmdline File opened for reading /proc/42/cmdline File opened for reading /proc/289/cmdline File opened for reading /proc/759/cmdline File opened for reading /proc/786/cmdline File opened for reading /proc/793/cmdline File opened for reading /proc/288/cmdline File opened for reading /proc/681/cmdline File opened for reading /proc/691/cmdline File opened for reading /proc/5/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/17/cmdline File opened for reading /proc/677/cmdline File opened for reading /proc/683/cmdline File opened for reading /proc/694/cmdline File opened for reading /proc/702/cmdline File opened for reading /proc/742/cmdline File opened for reading /proc/767/cmdline File opened for reading /proc/770/cmdline File opened for reading /proc/776/cmdline File opened for reading /proc/777/cmdline File opened for reading /proc/792/cmdline File opened for reading /proc/8/cmdline File opened for reading /proc/27/cmdline File opened for reading /proc/107/cmdline File opened for reading /proc/293/cmdline File opened for reading /proc/323/cmdline File opened for reading /proc/649/cmdline File opened for reading /proc/685/cmdline File opened for reading /proc/703/cmdline File opened for reading /proc/715/cmdline File opened for reading /proc/729/cmdline File opened for reading /proc/749/cmdline File opened for reading /proc/760/cmdline File opened for reading /proc/6/cmdline File opened for reading /proc/292/cmdline File opened for reading /proc/662/cmdline