Analysis
-
max time kernel
150s -
max time network
151s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240611-en -
resource tags
arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
21-11-2024 01:27
Behavioral task
behavioral1
Sample
5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
3 signatures
150 seconds
General
-
Target
5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf
-
Size
177KB
-
MD5
8f0d7edfcf7c290bbe7447cfd12635f4
-
SHA1
e58e5075440f88038766eaf8cd2e395a2ec8ecb4
-
SHA256
5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0
-
SHA512
d97474cd58c95fdc4494993c6afd1d8013580791274c67d3a227a8ad86085ebd56ead14260456983c1b53b1ca0be6f29c75e54f60c4a0cfa3f6d3757f7948aa6
-
SSDEEP
3072:Mwoe3sEiZt9nQiX/GpO1SMRpp6NWJdWQji:MnSspZDQiX/2ObRWoDWE
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 716 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf -
description ioc Process File opened for reading /proc/770/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/808/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/79/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/119/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/683/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/685/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/721/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/740/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/748/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/762/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/3/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/7/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/18/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/82/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/384/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/742/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/780/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/783/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/800/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/819/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/771/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/772/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/15/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/37/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/711/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/718/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/720/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/733/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/777/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/786/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/818/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/754/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/761/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/4/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/36/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/335/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/370/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/706/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/741/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/765/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/795/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/807/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/801/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/68/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/71/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/687/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/732/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/735/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/790/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/9/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/19/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/110/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/787/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/789/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/802/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/804/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/820/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/678/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/730/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/736/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/752/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/759/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/791/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf File opened for reading /proc/5/cmdline 5b498bb8372b66f7e8ba5bde9e14d0b47f1c8c1d4a3ceab30b22ba3c356ca2f0.elf