Analysis
-
max time kernel
150s -
max time network
152s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
14-12-2024 02:11
Behavioral task
behavioral1
Sample
03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf
-
Size
130KB
-
MD5
f4700cfa2b3e5367e6a61f9e310333b1
-
SHA1
1034f9841afe8396a4fa74c74b018d4df4cdabfd
-
SHA256
03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d
-
SHA512
91e18143e9dd5676e5ed521a0522ba96179906bc25bc5935393eecdba07bab32ec807801314140929269ca40e0809d39831985dcddf8253b8d03a10ab2fcd3d5
-
SSDEEP
1536:7P8g2CSJG5mIOd34rI1Au0Y1jAFrZ4V/3ETVOVHnauMpjpChwDjlkKwywVFN+24d:70FGvI1BV1jI45EROVHnutpCmiz/2H
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 667 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf -
description ioc Process File opened for reading /proc/753/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/757/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/763/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/24/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/622/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/681/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/683/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/729/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/7/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/701/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/708/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/782/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/5/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/165/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/665/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/728/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/793/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/659/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/670/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/736/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/778/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/15/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/42/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/722/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/756/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/783/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/23/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/97/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/287/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/668/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/685/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/718/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/746/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/764/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/10/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/138/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/700/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/711/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/715/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/761/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/772/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/6/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/316/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/703/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/710/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/731/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/767/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/769/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/671/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/696/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/707/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/738/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/744/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/733/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/752/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/760/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/776/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/20/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/28/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/43/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/680/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/770/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/759/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf File opened for reading /proc/404/cmdline 03ea02023df2f676540a34b40263d9a0a693085953a075dcee3acfd6d4015d8d.elf