6ba4368af53ef8ddecb7750e60b86495bc9649fdc5370fe5e70bb59e1dd32194

Analysis

max time kernel
140s
max time network
160s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
20-11-2024 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dvwkja7.elf
Size

178KB
MD5

ddf40003ed182c63697acb8769776307
SHA1

e47b3349e348df2532798fec9ef5839363b83fa7
SHA256

6ba4368af53ef8ddecb7750e60b86495bc9649fdc5370fe5e70bb59e1dd32194
SHA512

40d2e6698e86b00d900d28cdf3450b1ca117042a0f21da5b6c0b52dbcef65fc6a9efe93846c505d39d595adb48f40e0b986ff05fcc8027f00fe690ae5720f108
SSDEEP

3072:2DR+sU7Kl3IKScPxelSoAauHthDkJjYB71uGhLs5K5h0oXM/Rc9:2DR+Z7KlpScP0woAauHthDkhYHuMLs5w

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

dvwkja7.elf

pid process

707 dvwkja7.elf
Enumerates running processes
Discovers information about currently running processes on the system
Changes its process name 1 IoCs

Processes:

dvwkja7.elf

description ioc pid process

Changes the process name, possibly in an attempt to hide itself httpd 705 dvwkja7.elf

pid	process
707	dvwkja7.elf

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	httpd	705	dvwkja7.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

dvwkja7.elfps

description	ioc	process
File opened for reading	/proc/7777/cmdline	dvwkja7.elf
File opened for reading	/proc/9/environ	ps
File opened for reading	/proc/29/cmdline	ps
File opened for reading	/proc/46/status	ps
File opened for reading	/proc/73/stat	ps
File opened for reading	/proc/222m}/cmdline	dvwkja7.elf
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/4/stat	ps
File opened for reading	/proc/25/status	ps
File opened for reading	/proc/44/stat	ps
File opened for reading	/proc/647/environ	ps
File opened for reading	/proc/662/cmdline	ps
File opened for reading	/proc/1111r1/cmdline	dvwkja7.elf
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/42/status	ps
File opened for reading	/proc/188/status	ps
File opened for reading	/proc/212/cmdline	ps
File opened for reading	/proc/298/status	ps
File opened for reading	/proc/350/cmdline	ps
File opened for reading	/proc/647/cmdline	ps
File opened for reading	/proc/702/status	ps
File opened for reading	/proc/333�/cmdline	dvwkja7.elf
File opened for reading	/proc/7777W;/cmdline	dvwkja7.elf
File opened for reading	/proc/713/status	ps
File opened for reading	/proc/6/status	ps
File opened for reading	/proc/8/environ	ps
File opened for reading	/proc/10/cmdline	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/20/environ	ps
File opened for reading	/proc/194/status	ps
File opened for reading	/proc/707/stat	ps
File opened for reading	/proc/707/cmdline	ps
File opened for reading	/proc/709/cmdline	ps
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/213/environ	ps
File opened for reading	/proc/333�/cmdline	dvwkja7.elf
File opened for reading	/proc/333s�/cmdline	dvwkja7.elf
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/35/stat	ps
File opened for reading	/proc/56/cmdline	ps
File opened for reading	/proc/632/cmdline	ps
File opened for reading	/proc/1111F;/cmdline	dvwkja7.elf
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/7/cmdline	ps
File opened for reading	/proc/12/stat	ps
File opened for reading	/proc/26/cmdline	ps
File opened for reading	/proc/56/environ	ps
File opened for reading	/proc/298/stat	ps
File opened for reading	/proc/348/environ	ps
File opened for reading	/proc/702/stat	ps
File opened for reading	/proc/706/cmdline	ps
File opened for reading	/proc/1111E;/cmdline	dvwkja7.elf
File opened for reading	/proc/215/environ	ps
File opened for reading	/proc/348/cmdline	ps
File opened for reading	/proc/662/stat	ps
File opened for reading	/proc/555/cmdline	dvwkja7.elf
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/711/status	ps
File opened for reading	/proc/711/cmdline	ps
File opened for reading	/proc/20/cmdline	ps

/tmp/dvwkja7.elf
/tmp/dvwkja7.elf
1⤵
- Deletes itself
- Changes its process name
- Reads runtime system information
PID:705
- /bin/sh
  sh -c "ps -e -o pid,args="
  2⤵
  PID:709
- - /usr/bin/ps
    ps -e -o "pid,args="
    3⤵
    - Reads runtime system information
    PID:713

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads