Analysis
-
max time kernel
149s -
max time network
157s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
19-12-2024 02:31
Behavioral task
behavioral1
Sample
318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf
-
Size
130KB
-
MD5
40f9cdbf19376d19ff3ef5fca9289194
-
SHA1
bfd20653b0ab85622825731b60860367282ac549
-
SHA256
318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b
-
SHA512
2c6979581d1805f39a82698fecf17b349b9298c25c15bc197be67cbdc1db2cdb044ac530b3f07f0b224196855fc39aef29f70c6edd86604af8fea66893150ba1
-
SSDEEP
1536:LP8g2CSJG5mIOd34o1AE0Y1jAFrZ4V/3ETVONvva2MxjpChoDTl0bwywVFN+e4J8:L0FGM13V1jI45ERONvvmlpCe77QK
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 653 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf -
description ioc Process File opened for reading /proc/688/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/746/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/142/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/690/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/721/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/747/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/758/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/585/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/112/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/656/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/42/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/265/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/299/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/681/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/725/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/103/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/114/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/752/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/761/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/775/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/4/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/659/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/699/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/724/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/759/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/770/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/786/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/2/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/12/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/210/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/279/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/736/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/750/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/771/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/6/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/672/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/677/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/696/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/663/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/28/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/41/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/605/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/754/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/762/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/5/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/156/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/658/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/673/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/735/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/772/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/115/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/709/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/727/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/769/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/10/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/645/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/669/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/675/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/682/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/683/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/722/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/734/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/25/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf File opened for reading /proc/742/cmdline 318f3b4b6b2f531e4e751cabff838c28fe6428f98fd8afd2ed5b31dae14a4b0b.elf