Analysis
-
max time kernel
149s -
max time network
144s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
19/04/2024, 09:33
Behavioral task
behavioral1
Sample
89f09e0abcab98e6a7653d7e133af65c.elf
Resource
debian9-armhf-20240226-en
3 signatures
150 seconds
General
-
Target
89f09e0abcab98e6a7653d7e133af65c.elf
-
Size
138KB
-
MD5
89f09e0abcab98e6a7653d7e133af65c
-
SHA1
434ad3835d5ee67bb86b189ae420bf2453bb660d
-
SHA256
d8e594bd21c8178a8f6ba983515b17692cf782c6bbb372b5fa2e2069b9a79b49
-
SHA512
3a294b375169a6c49d88e4235174f63f6504be456d46f2d028a698aac36c7fd9a203d9ee0d1d2bc44f4ff55b4fc9c2e397a27b7adb75c79c52b1d70ea28752a1
-
SSDEEP
1536:7FFPNs9EKkIBONTrBCZI8tGFpAckj24V1Pl+Tnvg9gWs+AWeuRelVE9wywLFg4EZ:7FFl2EtBC9sFpz4b0rvg9gvtu8exLcC
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M"! 661 89f09e0abcab98e6a7653d7e133af65c.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/14/cmdline File opened for reading /proc/15/cmdline File opened for reading /proc/140/cmdline File opened for reading /proc/17/cmdline File opened for reading /proc/660/cmdline File opened for reading /proc/686/cmdline File opened for reading /proc/780/cmdline File opened for reading /proc/149/cmdline File opened for reading /proc/689/cmdline File opened for reading /proc/750/cmdline File opened for reading /proc/723/cmdline File opened for reading /proc/659/cmdline File opened for reading /proc/735/cmdline File opened for reading /proc/756/cmdline File opened for reading /proc/776/cmdline File opened for reading /proc/786/cmdline File opened for reading /proc/794/cmdline File opened for reading /proc/6/cmdline File opened for reading /proc/23/cmdline File opened for reading /proc/99/cmdline File opened for reading /proc/704/cmdline File opened for reading /proc/681/cmdline File opened for reading /proc/699/cmdline File opened for reading /proc/785/cmdline File opened for reading /proc/1/cmdline File opened for reading /proc/744/cmdline File opened for reading /proc/111/cmdline File opened for reading /proc/753/cmdline File opened for reading /proc/729/cmdline File opened for reading /proc/758/cmdline File opened for reading /proc/769/cmdline File opened for reading /proc/27/cmdline File opened for reading /proc/161/cmdline File opened for reading /proc/701/cmdline File opened for reading /proc/761/cmdline File opened for reading /proc/781/cmdline File opened for reading /proc/5/cmdline File opened for reading /proc/685/cmdline File opened for reading /proc/736/cmdline File opened for reading /proc/754/cmdline File opened for reading /proc/762/cmdline File opened for reading /proc/791/cmdline File opened for reading /proc/108/cmdline File opened for reading /proc/138/cmdline File opened for reading /proc/694/cmdline File opened for reading /proc/720/cmdline File opened for reading /proc/279/cmdline File opened for reading /proc/671/cmdline File opened for reading /proc/697/cmdline File opened for reading /proc/765/cmdline File opened for reading /proc/28/cmdline File opened for reading /proc/734/cmdline File opened for reading /proc/745/cmdline File opened for reading /proc/749/cmdline File opened for reading /proc/110/cmdline File opened for reading /proc/299/cmdline File opened for reading /proc/656/cmdline File opened for reading /proc/22/cmdline File opened for reading /proc/669/cmdline File opened for reading /proc/757/cmdline File opened for reading /proc/41/cmdline File opened for reading /proc/675/cmdline File opened for reading /proc/732/cmdline File opened for reading /proc/703/cmdline