Analysis
-
max time kernel
142s -
max time network
154s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
07/12/2024, 02:49
Behavioral task
behavioral1
Sample
71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf
-
Size
216KB
-
MD5
a838a51cfee62f7282043699912f0d02
-
SHA1
94b755819285a51b28b7a0b130ccf75407bd78fb
-
SHA256
71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2
-
SHA512
b695ef3034130188b68a70bdc4101d25a80338beaf96324774c30618f0d2327c00d2b9d44dec8ca55fa11d70f989ab6995da3f314b802fc9186c8c38b504631b
-
SSDEEP
6144:Rdq+j3uigacvucaDxoWCZGq8kvVpM+uxGM/RzMIDN:R/j3u2aucadoWCZHP9p2xf/uIB
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 661 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 659 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf -
description ioc Process File opened for reading /proc/111�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/222�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/222�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/2222T+/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/6666M4/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/11/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/111c�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/111c�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/2222�*/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/3333�./cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/6666j3/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/99/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/222l�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/1111�%/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/2222+*/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/3333q,/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/3333/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/111�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/1111�(/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/444s�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/1111X4/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/1111V4/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/1111�#/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/2222 +/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/44442/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/55/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/222i�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/6666\4/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/6666`4/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/1111�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/2222j,/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/3333Y4/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/4444[4/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/888s�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/2222Z*/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/3333�,/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/6666]4/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/6666^4/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/22/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/66/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/77/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/88ll�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/111m�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/222/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/222s�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/1111�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/1111W4/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/6666�3/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/66664/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/6666_4/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/444/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/2222�*/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/44/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/111/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/4444+/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/33/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/222v�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/1111�"/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf File opened for reading /proc/66664/cmdline 71e95046d72811647a5be9ccf43db086b588bbc94a3ce920a6b271b01263ace2.elf