Analysis
-
max time kernel
149s -
max time network
146s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
19/04/2024, 12:02
Behavioral task
behavioral1
Sample
20763f800034ce169e21e79d3cf9d11f61e86905ad8b0c516b354f9a3a2ac97f.elf
Resource
debian9-armhf-20240226-en
3 signatures
150 seconds
General
-
Target
20763f800034ce169e21e79d3cf9d11f61e86905ad8b0c516b354f9a3a2ac97f.elf
-
Size
130KB
-
MD5
cda551500e5101453d334f4daf3897c9
-
SHA1
523150722816ab01596bfae79fe99bae7e393602
-
SHA256
20763f800034ce169e21e79d3cf9d11f61e86905ad8b0c516b354f9a3a2ac97f
-
SHA512
7a3a8660514a9ffab9e3a26549cb19a78cdbac80fb2fb48f03795204d877f2f9bbf65cfef325593854888323f2eb19a2ba002286f61c27acbcc82cbcded59740
-
SSDEEP
3072:gHZ+Hko5xFOV48wlPRfYRXaPu0ccKOA9LT8iH4:gHZrSAV48MPRffU938iY
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M"! 640 20763f800034ce169e21e79d3cf9d11f61e86905ad8b0c516b354f9a3a2ac97f.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/19/cmdline File opened for reading /proc/649/cmdline File opened for reading /proc/673/cmdline File opened for reading /proc/731/cmdline File opened for reading /proc/737/cmdline File opened for reading /proc/770/cmdline File opened for reading /proc/10/cmdline File opened for reading /proc/98/cmdline File opened for reading /proc/6/cmdline File opened for reading /proc/639/cmdline File opened for reading /proc/662/cmdline File opened for reading /proc/665/cmdline File opened for reading /proc/732/cmdline File opened for reading /proc/3/cmdline File opened for reading /proc/684/cmdline File opened for reading /proc/725/cmdline File opened for reading /proc/744/cmdline File opened for reading /proc/9/cmdline File opened for reading /proc/12/cmdline File opened for reading /proc/654/cmdline File opened for reading /proc/695/cmdline File opened for reading /proc/18/cmdline File opened for reading /proc/690/cmdline File opened for reading /proc/696/cmdline File opened for reading /proc/748/cmdline File opened for reading /proc/29/cmdline File opened for reading /proc/657/cmdline File opened for reading /proc/700/cmdline File opened for reading /proc/704/cmdline File opened for reading /proc/724/cmdline File opened for reading /proc/735/cmdline File opened for reading /proc/758/cmdline File opened for reading /proc/26/cmdline File opened for reading /proc/653/cmdline File opened for reading /proc/671/cmdline File opened for reading /proc/762/cmdline File opened for reading /proc/1/cmdline File opened for reading /proc/138/cmdline File opened for reading /proc/142/cmdline File opened for reading /proc/668/cmdline File opened for reading /proc/701/cmdline File opened for reading /proc/728/cmdline File opened for reading /proc/742/cmdline File opened for reading /proc/749/cmdline File opened for reading /proc/694/cmdline File opened for reading /proc/702/cmdline File opened for reading /proc/730/cmdline File opened for reading /proc/739/cmdline File opened for reading /proc/16/cmdline File opened for reading /proc/110/cmdline File opened for reading /proc/658/cmdline File opened for reading /proc/720/cmdline File opened for reading /proc/721/cmdline File opened for reading /proc/729/cmdline File opened for reading /proc/13/cmdline File opened for reading /proc/267/cmdline File opened for reading /proc/687/cmdline File opened for reading /proc/697/cmdline File opened for reading /proc/632/cmdline File opened for reading /proc/23/cmdline File opened for reading /proc/771/cmdline File opened for reading /proc/717/cmdline File opened for reading /proc/638/cmdline File opened for reading /proc/669/cmdline