Analysis
- max time kernel
148s - max time network
149s - platform
debian-9_armhf - resource
debian9-armhf-20240729-en - resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
02/10/2024, 15:00
Behavioral task
behavioral1
Sample
arm7.elf
Resource
debian9-armhf-20240729-en
debian-9-armhf
4 signatures
150 seconds
General
- Target arm7.elf
- Size 135KB
- Sample241002-sdchxssejn
- SHA256 2cb128357da70985675ddaedbc686baea173846b6edd0b197600d1d2e903bc2f
- MD5 626cec0203d1d3f2d81368cf4ef3059f
- SHA1 d58a941afdac7bb85f06a46a3d283a3e15255515
- SHA512 480e5fcb83a449a54b3fa56c1d3aa87cd063f6d51eb8c0860338e6eecc7c774fbf20c56540a7a1e3d62ec8ac983cb863497a434ee61afd5bf86159e0062f9f06
- SSDEEP 3072:gVDwATfFE8KlaHzldtfY6ZonEA+pEipnVP+Mb0nM/9i+o:gVDwATWVlaHzldtA6enEManVP+MbcM/e
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 645 arm7.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 4 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself bash 646 arm7.elf Changes the process name, possibly in an attempt to hide itself nginx 647 arm7.elf Changes the process name, possibly in an attempt to hide itself inetd 648 arm7.elf Changes the process name, possibly in an attempt to hide itself sshd 649 arm7.elf -
description ioc Process File opened for reading /proc/13/cmdline arm7.elf File opened for reading /proc/16/cmdline arm7.elf File opened for reading /proc/23/cmdline arm7.elf File opened for reading /proc/266/cmdline arm7.elf File opened for reading /proc/643/cmdline arm7.elf File opened for reading /proc/763/cmdline arm7.elf File opened for reading /proc/27/cmdline arm7.elf File opened for reading /proc/43/cmdline arm7.elf File opened for reading /proc/583/cmdline arm7.elf File opened for reading /proc/640/cmdline arm7.elf File opened for reading /proc/767/cmdline arm7.elf File opened for reading /proc/781/cmdline arm7.elf File opened for reading /proc/3/cmdline arm7.elf File opened for reading /proc/302/cmdline arm7.elf File opened for reading /proc/308/cmdline arm7.elf File opened for reading /proc/637/cmdline arm7.elf File opened for reading /proc/19/cmdline arm7.elf File opened for reading /proc/22/cmdline arm7.elf File opened for reading /proc/24/cmdline arm7.elf File opened for reading /proc/28/cmdline arm7.elf File opened for reading /proc/75/cmdline arm7.elf File opened for reading /proc/137/cmdline arm7.elf File opened for reading /proc/163/cmdline arm7.elf File opened for reading /proc/762/cmdline arm7.elf File opened for reading /proc/769/cmdline arm7.elf File opened for reading /proc/18/cmdline arm7.elf File opened for reading /proc/631/cmdline arm7.elf File opened for reading /proc/8/cmdline arm7.elf File opened for reading /proc/17/cmdline arm7.elf File opened for reading /proc/752/cmdline arm7.elf File opened for reading /proc/773/cmdline arm7.elf File opened for reading /proc/10/cmdline arm7.elf File opened for reading /proc/29/cmdline arm7.elf File opened for reading /proc/41/cmdline arm7.elf File opened for reading /proc/105/cmdline arm7.elf File opened for reading /proc/108/cmdline arm7.elf File opened for reading /proc/755/cmdline arm7.elf File opened for reading /proc/771/cmdline arm7.elf File opened for reading /proc/147/cmdline arm7.elf File opened for reading /proc/216/cmdline arm7.elf File opened for reading /proc/271/cmdline arm7.elf File opened for reading /proc/642/cmdline arm7.elf File opened for reading /proc/757/cmdline arm7.elf File opened for reading /proc/777/cmdline arm7.elf File opened for reading /proc/5/cmdline arm7.elf File opened for reading /proc/6/cmdline arm7.elf File opened for reading /proc/21/cmdline arm7.elf File opened for reading /proc/97/cmdline arm7.elf File opened for reading /proc/265/cmdline arm7.elf File opened for reading /proc/649/cmdline arm7.elf File opened for reading /proc/775/cmdline arm7.elf File opened for reading /proc/653/cmdline arm7.elf File opened for reading /proc/11/cmdline arm7.elf File opened for reading /proc/12/cmdline arm7.elf File opened for reading /proc/26/cmdline arm7.elf File opened for reading /proc/42/cmdline arm7.elf File opened for reading /proc/270/cmdline arm7.elf File opened for reading /proc/582/cmdline arm7.elf File opened for reading /proc/598/cmdline arm7.elf File opened for reading /proc/765/cmdline arm7.elf File opened for reading /proc/107/cmdline arm7.elf File opened for reading /proc/268/cmdline arm7.elf File opened for reading /proc/301/cmdline arm7.elf File opened for reading /proc/638/cmdline arm7.elf