Analysis
- max time kernel
148s - max time network
150s - platform
debian-9_mips - resource
debian9-mipsbe-20240226-en - resource tags
arch:mipsimage:debian9-mipsbe-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
27/04/2024, 13:09
Behavioral task
behavioral1
Sample
4723edfc3a8872754aa38ac54a47a11a.elf
Resource
debian9-mipsbe-20240226-en
debian-9-mips
4 signatures
150 seconds
General
- Target 4723edfc3a8872754aa38ac54a47a11a.elf
- Size 70KB
- Sample240427-qdr79sbf5w
- SHA256 14779673d029ff29fd43844e96ff9dda440e75626ea145321438de4ea1e108df
- MD5 4723edfc3a8872754aa38ac54a47a11a
- SHA1 d9724639b5224a4f02d925b96e00cc7fe1dc5f9c
- SHA512 e308442b81d63e1c63355172d9fc2972b303e8491bd02fd968beae027187bb8b01c2e4a514448fe576324fd2263e64b8b20f5cfff6f4b73b79212a64a52997d6
- SSDEEP 768:bPWek0n4CjdGQKKWxmg0EhFkFkeYA+Qo6FXyApGqFDjOZ2uyyQ5NeNTP4wn8IZ:bj/hSmmjAo6dym2Uu6eBPZn8q
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 711 4723edfc3a8872754aa38ac54a47a11a.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 4 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself bash 712 Changes the process name, possibly in an attempt to hide itself nginx 713 Changes the process name, possibly in an attempt to hide itself inetd 714 Changes the process name, possibly in an attempt to hide itself sshd 715 - Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/703/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/4/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/337/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/367/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/72/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/73/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/365/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/706/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/707/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/10/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/12/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/17/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/126/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/676/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/16/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/22/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/79/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/419/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/14/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/75/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/383/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/13/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/20/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/21/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/37/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/74/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/1/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/6/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/9/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/677/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/714/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/84/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/160/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/368/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/772/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/5/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/18/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/127/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/155/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/669/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/690/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/704/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/2/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/76/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/110/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/19/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/251/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/709/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/77/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/715/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/8/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/71/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/334/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/82/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/710/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/794/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/7/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/23/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/36/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/81/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/673/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/370/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/3/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf File opened for reading /proc/15/cmdline 4723edfc3a8872754aa38ac54a47a11a.elf