Analysis
-
max time kernel
150s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
08-12-2024 02:28
Behavioral task
behavioral1
Sample
7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf
-
Size
134KB
-
MD5
d783504587c35e7c79a5b4dcd5f13b87
-
SHA1
683250294e68e0bf9a71c037215c240a98f87164
-
SHA256
7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd
-
SHA512
a08c5920b1baab526fd09e20633e4099442e005765aa80bea8293d5ddaff619ceb416fbac1e6f0131c8ef64473a8d413ea5ae566d26435b4f56ddc82b04087fc
-
SSDEEP
1536:LeIIcq87ZO8VQzlHauyUARDvlFFAeSv4VAZJsTgVsU8BD+2/oXd7lOrMwywmFfb2:6IIifcyUWDtFFQ4UiMVsU8XAXGRqvQL
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M " 661 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf -
description ioc Process File opened for reading /proc/750/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/779/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/788/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/168/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/465/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/670/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/706/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/739/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/794/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/785/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/793/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/12/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/19/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/680/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/687/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/717/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/754/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/26/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/692/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/755/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/756/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/795/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/765/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/766/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/270/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/616/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/688/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/689/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/711/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/786/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/796/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/705/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/736/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/748/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/752/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/784/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/699/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/704/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/727/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/2/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/6/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/353/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/509/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/697/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/679/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/759/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/772/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/790/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/743/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/761/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/24/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/43/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/136/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/725/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/730/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/684/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/723/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/682/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/708/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/709/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/13/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/647/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/653/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf File opened for reading /proc/654/cmdline 7e0d6994aa8215e3da3e9780724c47278287de916d366e765c08dde9f31168fd.elf