Analysis
-
max time kernel
149s -
max time network
135s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
29-11-2024 17:55
Behavioral task
behavioral1
Sample
bot.arm.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
bot.arm.elf
-
Size
130KB
-
MD5
abae89fadf4fd232876ce116cb46dba9
-
SHA1
c677d0eb539ae98c7332f0e545028d5d3588f2fd
-
SHA256
e36fecdff87334f7ac5122c8fb91c81b66b21685a831b57f42728cb88bfd93cf
-
SHA512
a351e5811e8bd8fdd3c0def85f4a0731ecd15a0a8490cacee46537e708759fa70248e6b2969fc9faf44eec072c65a9693d16a6f49add68f9a1d18986b336ad0a
-
SSDEEP
3072:AHZ+X3AoExFOV48wlPhPoRDaPuUcJ6OI9Lfwibd:AHZAADAV48MPhPOs9zwih
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 650 bot.arm.elf -
description ioc Process File opened for reading /proc/697/cmdline bot.arm.elf File opened for reading /proc/754/cmdline bot.arm.elf File opened for reading /proc/27/cmdline bot.arm.elf File opened for reading /proc/265/cmdline bot.arm.elf File opened for reading /proc/308/cmdline bot.arm.elf File opened for reading /proc/664/cmdline bot.arm.elf File opened for reading /proc/705/cmdline bot.arm.elf File opened for reading /proc/741/cmdline bot.arm.elf File opened for reading /proc/3/cmdline bot.arm.elf File opened for reading /proc/6/cmdline bot.arm.elf File opened for reading /proc/401/cmdline bot.arm.elf File opened for reading /proc/769/cmdline bot.arm.elf File opened for reading /proc/10/cmdline bot.arm.elf File opened for reading /proc/13/cmdline bot.arm.elf File opened for reading /proc/688/cmdline bot.arm.elf File opened for reading /proc/651/cmdline bot.arm.elf File opened for reading /proc/659/cmdline bot.arm.elf File opened for reading /proc/740/cmdline bot.arm.elf File opened for reading /proc/743/cmdline bot.arm.elf File opened for reading /proc/763/cmdline bot.arm.elf File opened for reading /proc/5/cmdline bot.arm.elf File opened for reading /proc/605/cmdline bot.arm.elf File opened for reading /proc/645/cmdline bot.arm.elf File opened for reading /proc/701/cmdline bot.arm.elf File opened for reading /proc/710/cmdline bot.arm.elf File opened for reading /proc/746/cmdline bot.arm.elf File opened for reading /proc/765/cmdline bot.arm.elf File opened for reading /proc/777/cmdline bot.arm.elf File opened for reading /proc/685/cmdline bot.arm.elf File opened for reading /proc/687/cmdline bot.arm.elf File opened for reading /proc/700/cmdline bot.arm.elf File opened for reading /proc/778/cmdline bot.arm.elf File opened for reading /proc/722/cmdline bot.arm.elf File opened for reading /proc/760/cmdline bot.arm.elf File opened for reading /proc/761/cmdline bot.arm.elf File opened for reading /proc/781/cmdline bot.arm.elf File opened for reading /proc/305/cmdline bot.arm.elf File opened for reading /proc/683/cmdline bot.arm.elf File opened for reading /proc/695/cmdline bot.arm.elf File opened for reading /proc/707/cmdline bot.arm.elf File opened for reading /proc/735/cmdline bot.arm.elf File opened for reading /proc/775/cmdline bot.arm.elf File opened for reading /proc/95/cmdline bot.arm.elf File opened for reading /proc/672/cmdline bot.arm.elf File opened for reading /proc/704/cmdline bot.arm.elf File opened for reading /proc/719/cmdline bot.arm.elf File opened for reading /proc/768/cmdline bot.arm.elf File opened for reading /proc/4/cmdline bot.arm.elf File opened for reading /proc/147/cmdline bot.arm.elf File opened for reading /proc/698/cmdline bot.arm.elf File opened for reading /proc/665/cmdline bot.arm.elf File opened for reading /proc/682/cmdline bot.arm.elf File opened for reading /proc/702/cmdline bot.arm.elf File opened for reading /proc/720/cmdline bot.arm.elf File opened for reading /proc/733/cmdline bot.arm.elf File opened for reading /proc/1/cmdline bot.arm.elf File opened for reading /proc/2/cmdline bot.arm.elf File opened for reading /proc/648/cmdline bot.arm.elf File opened for reading /proc/715/cmdline bot.arm.elf File opened for reading /proc/732/cmdline bot.arm.elf File opened for reading /proc/770/cmdline bot.arm.elf File opened for reading /proc/771/cmdline bot.arm.elf File opened for reading /proc/773/cmdline bot.arm.elf File opened for reading /proc/649/cmdline bot.arm.elf