Analysis
-
max time kernel
132s -
max time network
148s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
12-12-2024 02:49
Behavioral task
behavioral1
Sample
db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
4 signatures
150 seconds
General
-
Target
db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf
-
Size
211KB
-
MD5
cc46ad336ea582beb1e6bf06871efccb
-
SHA1
bf95a69fa2704c2cadd2de7fedd6b573489f8a3e
-
SHA256
db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d
-
SHA512
1206b0e0c79ad1d0e7a77b9a16b1afded0e19198fd3df094524b0688fa7a168511fc055d58d4f7957fc1c035ef2d1fa4251ce74146b04b1fb4fcdcaeba2c5cb1
-
SSDEEP
6144:9LziNEEQ/s8OFR3h0sEiaUVB1ILe6uuQdtEwCSw0M/RZmhY:96NHMLc39EiaaB1ILXPgEKwJ/HmO
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 713 db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 710 db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf -
description ioc Process File opened for reading /proc/188/environ ps File opened for reading /proc/324/status ps File opened for reading /proc/11/cmdline db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf File opened for reading /proc/6666�7/cmdline db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf File opened for reading /proc/23/cmdline ps File opened for reading /proc/30/cmdline ps File opened for reading /proc/34/status ps File opened for reading /proc/142/stat ps File opened for reading /proc/208/stat ps File opened for reading /proc/221/environ ps File opened for reading /proc/1111f0/cmdline db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf File opened for reading /proc/6/stat ps File opened for reading /proc/12/stat ps File opened for reading /proc/30/stat ps File opened for reading /proc/678/stat ps File opened for reading /proc/316/stat ps File opened for reading /proc/327/status ps File opened for reading /proc/345/cmdline ps File opened for reading /proc/631/stat ps File opened for reading /proc/21/stat ps File opened for reading /proc/22/cmdline ps File opened for reading /proc/222v�/cmdline db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf File opened for reading /proc/2222�3/cmdline db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf File opened for reading /proc/2/stat ps File opened for reading /proc/20/status ps File opened for reading /proc/188/stat ps File opened for reading /proc/645/cmdline ps File opened for reading /proc/716/stat ps File opened for reading /proc/33/cmdline db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf File opened for reading /proc/222�/cmdline db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf File opened for reading /proc/333�/cmdline db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf File opened for reading /proc/9/environ ps File opened for reading /proc/6666X;/cmdline db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf File opened for reading /proc/3/environ ps File opened for reading /proc/33/status ps File opened for reading /proc/317/status ps File opened for reading /proc/22/environ ps File opened for reading /proc/342/cmdline ps File opened for reading /proc/714/cmdline ps File opened for reading /proc/3333�4/cmdline db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf File opened for reading /proc/6666�:/cmdline db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf File opened for reading /proc/2/status ps File opened for reading /proc/4/cmdline ps File opened for reading /proc/57/cmdline ps File opened for reading /proc/247/environ ps File opened for reading /proc/3333)5/cmdline db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf File opened for reading /proc/6666�8/cmdline db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf File opened for reading /proc/26/stat ps File opened for reading /proc/29/status ps File opened for reading /proc/20/environ ps File opened for reading /proc/310/environ ps File opened for reading /proc/646/stat ps File opened for reading /proc/333/cmdline db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf File opened for reading /proc/4/status ps File opened for reading /proc/4/environ ps File opened for reading /proc/19/cmdline ps File opened for reading /proc/12/status ps File opened for reading /proc/18/environ ps File opened for reading /proc/51/stat ps File opened for reading /proc/327/stat ps File opened for reading /proc/444/cmdline db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf File opened for reading /proc/29/environ ps File opened for reading /proc/42/cmdline ps File opened for reading /proc/46/cmdline ps
Processes
-
/tmp/db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf/tmp/db7fedf7dc012292b4490f3c526c2f3f8dbbc5542da74551f8f0ec15bab3a01d.elf1⤵
- Deletes itself
- Changes its process name
- Reads runtime system information
PID:710 -
/bin/shsh -c "ps -e -o pid,args="2⤵PID:716
-
/usr/bin/psps -e -o "pid,args="3⤵
- Reads runtime system information
PID:718
-
-