Analysis
-
max time kernel
150s -
max time network
158s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
01-12-2024 02:23
Behavioral task
behavioral1
Sample
32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf
-
Size
130KB
-
MD5
35e26c103bfe7271da13ba1b34c8c427
-
SHA1
5e6f5e52565ef44c28e83648edd6baa2e36a894f
-
SHA256
32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822
-
SHA512
08d7545f93c062f965f248aea4e8c2f631a7249c2bd9166f6c52488a8206f822128ea55d6ddae18c0d7b064db37d1ba7568e4987dec70010c54481d4635ee252
-
SSDEEP
1536:zP8g2CSJG5mIOd34M1Ae0Y1jAFrZ4V/3ETVORjbaiMtjpChMDzlkHwywVFN+a41z:z0FGo1ZV1jI45ERORjbCZpCKnXQL
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M " 668 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf -
description ioc Process File opened for reading /proc/772/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/776/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/24/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/666/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/690/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/784/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/468/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/681/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/106/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/109/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/683/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/770/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/801/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/16/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/75/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/18/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/745/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/765/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/778/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/788/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/803/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/3/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/13/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/752/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/785/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/720/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/746/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/654/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/721/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/723/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/729/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/734/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/748/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/1/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/43/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/667/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/698/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/165/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/663/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/730/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/800/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/307/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/693/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/714/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/28/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/621/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/739/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/695/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/704/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/20/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/660/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/680/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/703/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/725/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/771/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/4/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/11/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/791/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/711/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/727/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/762/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/769/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/41/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf File opened for reading /proc/278/cmdline 32e6d50e2c57e27849f3fcd3f723801bebade853d33fe24981b563de3cd09822.elf