Analysis
-
max time kernel
150s -
max time network
152s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
07-12-2024 00:35
Behavioral task
behavioral1
Sample
bot.arm.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
bot.arm.elf
-
Size
134KB
-
MD5
d783504587c35e7c79a5b4dcd5f13b87
-
SHA1
683250294e68e0bf9a71c037215c240a98f87164
-
SHA256
7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd
-
SHA512
a08c5920b1baab526fd09e20633e4099442e005765aa80bea8293d5ddaff619ceb416fbac1e6f0131c8ef64473a8d413ea5ae566d26435b4f56ddc82b04087fc
-
SSDEEP
1536:LeIIcq87ZO8VQzlHauyUARDvlFFAeSv4VAZJsTgVsU8BD+2/oXd7lOrMwywmFfb2:6IIifcyUWDtFFQ4UiMVsU8XAXGRqvQL
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M " 666 bot.arm.elf -
description ioc Process File opened for reading /proc/676/cmdline bot.arm.elf File opened for reading /proc/678/cmdline bot.arm.elf File opened for reading /proc/741/cmdline bot.arm.elf File opened for reading /proc/713/cmdline bot.arm.elf File opened for reading /proc/717/cmdline bot.arm.elf File opened for reading /proc/788/cmdline bot.arm.elf File opened for reading /proc/764/cmdline bot.arm.elf File opened for reading /proc/27/cmdline bot.arm.elf File opened for reading /proc/138/cmdline bot.arm.elf File opened for reading /proc/695/cmdline bot.arm.elf File opened for reading /proc/734/cmdline bot.arm.elf File opened for reading /proc/758/cmdline bot.arm.elf File opened for reading /proc/763/cmdline bot.arm.elf File opened for reading /proc/682/cmdline bot.arm.elf File opened for reading /proc/727/cmdline bot.arm.elf File opened for reading /proc/731/cmdline bot.arm.elf File opened for reading /proc/782/cmdline bot.arm.elf File opened for reading /proc/783/cmdline bot.arm.elf File opened for reading /proc/794/cmdline bot.arm.elf File opened for reading /proc/5/cmdline bot.arm.elf File opened for reading /proc/29/cmdline bot.arm.elf File opened for reading /proc/696/cmdline bot.arm.elf File opened for reading /proc/707/cmdline bot.arm.elf File opened for reading /proc/751/cmdline bot.arm.elf File opened for reading /proc/779/cmdline bot.arm.elf File opened for reading /proc/754/cmdline bot.arm.elf File opened for reading /proc/761/cmdline bot.arm.elf File opened for reading /proc/17/cmdline bot.arm.elf File opened for reading /proc/284/cmdline bot.arm.elf File opened for reading /proc/674/cmdline bot.arm.elf File opened for reading /proc/690/cmdline bot.arm.elf File opened for reading /proc/712/cmdline bot.arm.elf File opened for reading /proc/739/cmdline bot.arm.elf File opened for reading /proc/725/cmdline bot.arm.elf File opened for reading /proc/3/cmdline bot.arm.elf File opened for reading /proc/96/cmdline bot.arm.elf File opened for reading /proc/721/cmdline bot.arm.elf File opened for reading /proc/792/cmdline bot.arm.elf File opened for reading /proc/20/cmdline bot.arm.elf File opened for reading /proc/677/cmdline bot.arm.elf File opened for reading /proc/722/cmdline bot.arm.elf File opened for reading /proc/724/cmdline bot.arm.elf File opened for reading /proc/735/cmdline bot.arm.elf File opened for reading /proc/708/cmdline bot.arm.elf File opened for reading /proc/726/cmdline bot.arm.elf File opened for reading /proc/11/cmdline bot.arm.elf File opened for reading /proc/14/cmdline bot.arm.elf File opened for reading /proc/447/cmdline bot.arm.elf File opened for reading /proc/661/cmdline bot.arm.elf File opened for reading /proc/691/cmdline bot.arm.elf File opened for reading /proc/698/cmdline bot.arm.elf File opened for reading /proc/753/cmdline bot.arm.elf File opened for reading /proc/759/cmdline bot.arm.elf File opened for reading /proc/784/cmdline bot.arm.elf File opened for reading /proc/793/cmdline bot.arm.elf File opened for reading /proc/6/cmdline bot.arm.elf File opened for reading /proc/15/cmdline bot.arm.elf File opened for reading /proc/657/cmdline bot.arm.elf File opened for reading /proc/694/cmdline bot.arm.elf File opened for reading /proc/730/cmdline bot.arm.elf File opened for reading /proc/740/cmdline bot.arm.elf File opened for reading /proc/269/cmdline bot.arm.elf File opened for reading /proc/665/cmdline bot.arm.elf File opened for reading /proc/687/cmdline bot.arm.elf