Analysis
- max time kernel
132s - max time network
149s - platform
debian-9_mips - resource
debian9-mipsbe-20240226-en - resource tags
arch:mipsimage:debian9-mipsbe-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
01/05/2024, 01:03
Behavioral task
behavioral1
Sample
14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf
Resource
debian9-mipsbe-20240226-en
debian-9-mips
4 signatures
150 seconds
General
- Target 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf
- Size 105KB
- Sample240501-begqlaca5x
- SHA256 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f
- MD5 52c8293080c0ccc1bb47d95c8a0ad01b
- SHA1 bd5ec27c22272b24b3df540039793250972184d1
- SHA512 3e9cdfd8542d0ad02c6bcf3d4e02b8f353e3e120142c0030a637830609735c55bdbe50016417d4f05920bd7183bc63891d42ca264f2c923674dfc90ace5940d2
- SSDEEP 1536:d3kl7hcFsVD0x+g1PvDAo/ZaKLWujMTDWe3cMSZaaxSiLzS1:Ol7hus6ZaKLWGMTD/gaaDS
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid 713 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 712 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf - Reads runtime system information 56 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/3/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/16/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/672/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/74/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/127/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/392/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/9/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/12/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/24/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/73/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/76/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/177/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/332/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/4/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/5/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/7/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/17/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/2/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/6/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/23/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/160/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/330/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/10/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/22/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/75/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/126/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/8/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/36/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/417/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/13/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/79/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/363/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/37/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/83/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/14/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/80/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/110/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/358/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/333/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/15/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/18/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/21/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/70/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/11/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/20/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/72/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/153/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/19/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/381/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/668/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/675/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/71/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/77/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/378/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/82/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf File opened for reading /proc/246/cmdline 14066d7c3b2f793bad6ca8bd8ca6d99ae09096bae81bcd0066b3c033ccb6f36f.elf