Analysis
-
max time kernel
150s -
max time network
154s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
19-08-2024 01:07
Behavioral task
behavioral1
Sample
02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
3 signatures
150 seconds
General
-
Target
02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf
-
Size
173KB
-
MD5
31d6a09621d510f09ce143b7b60ff9c9
-
SHA1
c3db40e7722f367ff8b33301a93f1ae1f3d30ee1
-
SHA256
02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e
-
SHA512
f7d1498d39ea6dedeb44a30b118828128b5c321dffce651cd2c11288065c55962397ebc2876d2d0a12692e57aa554887b616b2a20ab2071f07f6235d58260498
-
SSDEEP
3072:ueEksFM+wX5OTaVR8H3NaMZOTTMJxt9U+7fKbZE:ueEnO+wXfVWdaMATwJHy+ut
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
Processes:
02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elfdescription ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 740 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elfdescription ioc Process File opened for reading /proc/336/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/667/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/4/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/37/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/58/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/779/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/16/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/744/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/756/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/769/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/771/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/44/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/112/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/679/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/22/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/111/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/181/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/2/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/6/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/760/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/20/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/24/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/31/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/118/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/768/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/776/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/13/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/23/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/388/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/25/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/711/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/741/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/7/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/34/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/695/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/753/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/763/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/730/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/758/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/773/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/777/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/53/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/136/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/379/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/754/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/764/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/774/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/32/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/113/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/201/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/755/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/775/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/745/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/778/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/785/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/59/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/697/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/735/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/401/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/710/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/731/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/15/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/19/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf File opened for reading /proc/47/cmdline 02940ae0ab776f9f885856e52b66394b6f1ed80e370bc1b19bd7a435eb43950e.elf