Analysis
-
max time kernel
600s -
max time network
602s -
platform
debian-12_armhf -
resource
debian12-armhf-20240418-en -
resource tags
arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
18-08-2024 16:06
Static task
static1
Behavioral task
behavioral1
Sample
3105114.bin
Resource
debian12-armhf-20240418-en
debian-12-armhf
6 signatures
600 seconds
General
-
Target
3105114.bin
-
Size
115KB
-
MD5
c3c1c6803141e720ba63cd168cc5712c
-
SHA1
40986073cff0b4ee1b7ef4ccfb3620b53bc7f174
-
SHA256
9ea845aa28dba907ee2abc3a3dc2c50bfbc593bfaa4b1a4e40dba83c3468b45b
-
SHA512
2a48a05ae346ea6a6efd56c9d07501f60a304f2be6a42a9f86c0279d0a38c1777c56aa2f2aa76736469a1c9d9b7e6c431e4a0b05002dbfc304f4443dfcbfaea9
-
SSDEEP
3072:hzoMfD4gqnu9hO5gGJkkYavCMM/9WAqdz:loMfDdyu9hO57Jgav9M/9WAqdz
Score
9/10
Malware Config
Signatures
-
Contacts a large (94852) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
pid 708 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself 708 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/709/maps 3105114.bin File opened for reading /proc/744/maps 3105114.bin File opened for reading /proc/10/exe 3105114.bin File opened for reading /proc/16/exe 3105114.bin File opened for reading /proc/27/maps 3105114.bin File opened for reading /proc/27/exe 3105114.bin File opened for reading /proc/46/exe 3105114.bin File opened for reading /proc/685/maps 3105114.bin File opened for reading /proc/785/maps 3105114.bin File opened for reading /proc/7/maps 3105114.bin File opened for reading /proc/36/maps 3105114.bin File opened for reading /proc/51/exe 3105114.bin File opened for reading /proc/363/maps 3105114.bin File opened for reading /proc/699/exe 3105114.bin File opened for reading /proc/711/maps 3105114.bin File opened for reading /proc/42/maps 3105114.bin File opened for reading /proc/238/maps 3105114.bin File opened for reading /proc/6/exe 3105114.bin File opened for reading /proc/12/exe 3105114.bin File opened for reading /proc/35/exe 3105114.bin File opened for reading /proc/45/exe 3105114.bin File opened for reading /proc/664/maps 3105114.bin File opened for reading /proc/14/exe 3105114.bin File opened for reading /proc/18/exe 3105114.bin File opened for reading /proc/708/exe 3105114.bin File opened for reading /proc/768/exe 3105114.bin File opened for reading /proc/2/exe 3105114.bin File opened for reading /proc/13/maps 3105114.bin File opened for reading /proc/34/maps 3105114.bin File opened for reading /proc/17/exe 3105114.bin File opened for reading /proc/26/exe 3105114.bin File opened for reading /proc/73/exe 3105114.bin File opened for reading /proc/711/exe 3105114.bin File opened for reading /proc/715/maps 3105114.bin File opened for reading /proc/16/maps 3105114.bin File opened for reading /proc/44/maps 3105114.bin File opened for reading /proc/238/exe 3105114.bin File opened for reading /proc/634/maps 3105114.bin File opened for reading /proc/745/maps 3105114.bin File opened for reading /proc/8/exe 3105114.bin File opened for reading /proc/22/exe 3105114.bin File opened for reading /proc/25/exe 3105114.bin File opened for reading /proc/44/exe 3105114.bin File opened for reading /proc/354/maps 3105114.bin File opened for reading /proc/667/maps 3105114.bin File opened for reading /proc/25/maps 3105114.bin File opened for reading /proc/325/maps 3105114.bin File opened for reading /proc/348/maps 3105114.bin File opened for reading /proc/710/maps 3105114.bin File opened for reading /proc/787/maps 3105114.bin File opened for reading /proc/788/maps 3105114.bin File opened for reading /proc/31/exe 3105114.bin File opened for reading /proc/32/exe 3105114.bin File opened for reading /proc/34/exe 3105114.bin File opened for reading /proc/36/exe 3105114.bin File opened for reading /proc/45/maps 3105114.bin File opened for reading /proc/712/maps 3105114.bin File opened for reading /proc/787/exe 3105114.bin File opened for reading /proc/18/maps 3105114.bin File opened for reading /proc/46/maps 3105114.bin File opened for reading /proc/195/exe 3105114.bin File opened for reading /proc/279/maps 3105114.bin File opened for reading /proc/699/maps 3105114.bin File opened for reading /proc/704/exe 3105114.bin