Analysis
- max time kernel
139s - max time network
147s - platform
debian-12_mipsel - resource
debian12-mipsel-20240221-en - resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
01/05/2024, 01:36
Behavioral task
behavioral1
Sample
71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
4 signatures
150 seconds
General
- Target 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf
- Size 107KB
- Sample240501-b1hvsaeh49
- SHA256 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d
- MD5 0443568f1f01b3a604b811f3ced3483e
- SHA1 de950023da205bdca5210b984a8ca84b52d577d4
- SHA512 b59cb2539f22ce1cc4d94b3b366022dedaaa0b22a5cb908734c000b8e5025417a367e02aa138cdbf28e2fd91e3a0ef4565e802d6165cd2e7e6c3f6167ffd6ae7
- SSDEEP 1536:HAXJZtGTIE6xOGydThWA4sojYsztmovggQMqueuZG15SdR7opm7zUb+nK0xSiH:HqJ7GTIE6xIuglueufoupnK0/
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid 729 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 727 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf - Reads runtime system information 63 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/11/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/16/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/257/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/8/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/27/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/179/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/29/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/37/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/53/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/112/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/113/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/20/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/201/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/427/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/5/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/23/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/25/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/47/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/9/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/114/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/541/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/12/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/13/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/19/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/118/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/14/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/34/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/45/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/393/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/394/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/22/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/24/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/28/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/33/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/115/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/4/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/18/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/30/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/137/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/6/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/10/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/385/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/2/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/35/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/58/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/358/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/550/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/3/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/7/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/17/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/21/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/378/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/136/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/353/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/355/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/15/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/31/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/32/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/42/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/59/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/26/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/48/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf File opened for reading /proc/683/cmdline 71f912a487849444525447465c686081482debe7045489572fc3b93b19efe77d.elf