Analysis
- max time kernel
134s - max time network
150s - platform
debian-9_armhf - resource
debian9-armhf-20240226-en - resource tags
arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
01/05/2024, 01:21
Behavioral task
behavioral1
Sample
76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf
Resource
debian9-armhf-20240226-en
debian-9-armhf
3 signatures
150 seconds
General
- Target 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf
- Size 126KB
- Sample240501-bqs8rsed85
- SHA256 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e
- MD5 4c752812acfacb700d0ca27546ea86c3
- SHA1 a5551269a90fa98bf519ae8d8b2f1cc50ce802a7
- SHA512 59d4d451b0d05754a9628905e86a2ea585c5e20e8ec78f34437e8b627ac54ff683a919c6ca41d26600668dea29997242acd76149d6982a0fd38eb837167ab248
- SSDEEP 1536:Jtv+s43G5bUWk9RA7Sh71QAFMxK4VIGUT2yFyFO/ukA46n7tVlYm+wyw1FrR7LVx:jv+XQORsg71QNE43UqyFyFOu467Q4Hb
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 661 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf - Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/698/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/700/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/714/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/719/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/108/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/686/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/691/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/692/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/748/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/767/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/313/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/679/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/711/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/766/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/18/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/43/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/138/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/168/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/782/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/756/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/13/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/656/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/743/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/751/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/654/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/672/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/675/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/777/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/757/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/771/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/784/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/6/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/22/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/677/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/688/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/759/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/10/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/664/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/737/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/747/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/720/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/778/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/457/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/653/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/665/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/670/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/776/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/3/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/29/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/671/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/716/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/696/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/709/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/772/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/7/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/16/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/673/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/695/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/1/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/707/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/740/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/773/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/712/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf File opened for reading /proc/755/cmdline 76897fc484902e5e2b9d233af256243fd98ad2b64393db578052e41827e1a65e.elf