Analysis
-
max time kernel
151s -
max time network
149s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
18-08-2024 08:47
Behavioral task
behavioral1
Sample
02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
3 signatures
150 seconds
General
-
Target
02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf
-
Size
173KB
-
MD5
31d6a09621d510f09ce143b7b60ff9c9
-
SHA1
c3db40e7722f367ff8b33301a93f1ae1f3d30ee1
-
SHA256
02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e
-
SHA512
f7d1498d39ea6dedeb44a30b118828128b5c321dffce651cd2c11288065c55962397ebc2876d2d0a12692e57aa554887b616b2a20ab2071f07f6235d58260498
-
SSDEEP
3072:ueEksFM+wX5OTaVR8H3NaMZOTTMJxt9U+7fKbZE:ueEnO+wXfVWdaMATwJHy+ut
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
Processes:
02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elfdescription ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 749 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elfdescription ioc Process File opened for reading /proc/739/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/783/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/16/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/20/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/30/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/13/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/380/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/7/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/377/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/2/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/673/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/763/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/14/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/774/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/744/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/778/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/6/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/11/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/34/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/757/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/758/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/776/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/768/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/770/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/772/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/789/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/23/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/661/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/761/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/746/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/788/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/12/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/35/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/700/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/115/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/136/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/408/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/766/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/3/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/19/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/58/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/714/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/724/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/756/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/779/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/1/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/18/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/343/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/22/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/355/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/786/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/379/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/410/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/771/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/9/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/25/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/755/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/26/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/33/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/391/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/696/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/707/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/716/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/760/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf