Analysis
-
max time kernel
135s -
max time network
152s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
11-12-2024 09:09
Behavioral task
behavioral1
Sample
dvwkja7.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
4 signatures
150 seconds
General
-
Target
dvwkja7.elf
-
Size
211KB
-
MD5
cc46ad336ea582beb1e6bf06871efccb
-
SHA1
bf95a69fa2704c2cadd2de7fedd6b573489f8a3e
-
SHA256
db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d
-
SHA512
1206b0e0c79ad1d0e7a77b9a16b1afded0e19198fd3df094524b0688fa7a168511fc055d58d4f7957fc1c035ef2d1fa4251ce74146b04b1fb4fcdcaeba2c5cb1
-
SSDEEP
6144:9LziNEEQ/s8OFR3h0sEiaUVB1ILe6uuQdtEwCSw0M/RZmhY:96NHMLc39EiaaB1ILXPgEKwJ/HmO
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 710 dvwkja7.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 708 dvwkja7.elf -
description ioc Process File opened for reading /proc/18/stat ps File opened for reading /proc/58/cmdline ps File opened for reading /proc/341/stat ps File opened for reading /proc/222l�/cmdline dvwkja7.elf File opened for reading /proc/12/status ps File opened for reading /proc/20/cmdline ps File opened for reading /proc/24/status ps File opened for reading /proc/24/cmdline ps File opened for reading /proc/248/status ps File opened for reading /proc/474/status ps File opened for reading /proc/627/status ps File opened for reading /proc/7777�;/cmdline dvwkja7.elf File opened for reading /proc/315/stat ps File opened for reading /proc/340/stat ps File opened for reading /proc/342/environ ps File opened for reading /proc/356/stat ps File opened for reading /proc/7777�;/cmdline dvwkja7.elf File opened for reading /proc/1/cmdline ps File opened for reading /proc/3/environ ps File opened for reading /proc/4/cmdline ps File opened for reading /proc/14/status ps File opened for reading /proc/35/status ps File opened for reading /proc/25/environ ps File opened for reading /proc/28/stat ps File opened for reading /proc/32/cmdline ps File opened for reading /proc/714/environ ps File opened for reading /proc/444s�/cmdline dvwkja7.elf File opened for reading /proc/777/cmdline dvwkja7.elf File opened for reading /proc/13/stat ps File opened for reading /proc/18/status ps File opened for reading /proc/1111Z0/cmdline dvwkja7.elf File opened for reading /proc/45/environ ps File opened for reading /proc/323/status ps File opened for reading /proc/684/environ ps File opened for reading /proc/1/environ ps File opened for reading /proc/10/environ ps File opened for reading /proc/340/environ ps File opened for reading /proc/333s�/cmdline dvwkja7.elf File opened for reading /proc/uptime ps File opened for reading /proc/27/stat ps File opened for reading /proc/188/environ ps File opened for reading /proc/342/stat ps File opened for reading /proc/622/stat ps File opened for reading /proc/701/status ps File opened for reading /proc/3/status ps File opened for reading /proc/12/stat ps File opened for reading /proc/21/cmdline ps File opened for reading /proc/24/environ ps File opened for reading /proc/203/environ ps File opened for reading /proc/627/environ ps File opened for reading /proc/701/environ ps File opened for reading /proc/99ssh/cmdline dvwkja7.elf File opened for reading /proc/111/cmdline dvwkja7.elf File opened for reading /proc/8/stat ps File opened for reading /proc/13/environ ps File opened for reading /proc/23/status ps File opened for reading /proc/143/status ps File opened for reading /proc/356/cmdline ps File opened for reading /proc/683/cmdline ps File opened for reading /proc/74/stat ps File opened for reading /proc/221/environ ps File opened for reading /proc/716/stat ps File opened for reading /proc/1111�;/cmdline dvwkja7.elf File opened for reading /proc/5/stat ps