Analysis
-
max time kernel
149s -
max time network
166s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
08-08-2024 01:39
Static task
static1
Behavioral task
behavioral1
Sample
9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
6 signatures
150 seconds
General
-
Target
9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf
-
Size
115KB
-
MD5
c3c1c6803141e720ba63cd168cc5712c
-
SHA1
40986073cff0b4ee1b7ef4ccfb3620b53bc7f174
-
SHA256
9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b
-
SHA512
2a48a05ae346ea6a6efd56c9d07501f60a304f2be6a42a9f86c0279d0a38c1777c56aa2f2aa76736469a1c9d9b7e6c431e4a0b05002dbfc304f4443dfcbfaea9
-
SSDEEP
3072:hzoMfD4gqnu9hO5gGJkkYavCMM/9WAqdz:loMfDdyu9hO57Jgav9M/9WAqdz
Score
9/10
Malware Config
Signatures
-
Contacts a large (23532) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
Processes:
pid 706 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
Processes:
description ioc pid Changes the process name, possibly in an attempt to hide itself 706 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elfdescription ioc Process File opened for reading /proc/7/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/28/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/312/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/772/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/51/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/186/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/648/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/706/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/709/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/732/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/31/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/35/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/56/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/706/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/2/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/26/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/708/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/20/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/24/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/73/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/322/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/628/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/630/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/3/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/42/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/194/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/5/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/33/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/325/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/701/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/8/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/10/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/27/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/220/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/757/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/678/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/709/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/4/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/8/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/13/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/22/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/25/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/46/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/36/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/310/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/358/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/647/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/3/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/14/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/18/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/34/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/757/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/142/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/248/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/1/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/7/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/30/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/31/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/45/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/57/exe 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/35/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/51/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/708/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf File opened for reading /proc/764/maps 9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b.elf