Analysis
-
max time kernel
150s -
max time network
149s -
platform
debian-12_armhf -
resource
debian12-armhf-20240418-en -
resource tags
arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
19-12-2024 03:45
Behavioral task
behavioral1
Sample
b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf
Resource
debian12-armhf-20240418-en
debian-12-armhf
3 signatures
150 seconds
General
-
Target
b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf
-
Size
180KB
-
MD5
c0f6cac3e24b52c3e8eccdbb130fccec
-
SHA1
a7f21a56f8aa321efaa76ef521364d4f11b22ed1
-
SHA256
b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3
-
SHA512
ead0be42a8862ddef2063136ac0d0f8e55e53527f46f57340461fdf378327446dd22346b3a6a8497e9d6b7e889aeebaebb3076bd4aba27dbace547a6e8a181b9
-
SSDEEP
3072:5UStdNRma1W9YHk9ah/QqXFgwakY7mo6nx/YpEoGM/RhkwLTNN:qSnNN1W6E9ah/Qq1gB2o2x/yJGM/Rhku
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 705 b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf -
description ioc Process File opened for reading /proc/742/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/744/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/725/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/726/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/729/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/748/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/753/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/142/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/708/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/46/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/51/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/322/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/715/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/718/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/730/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/301/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/731/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/752/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/32/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/45/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/703/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/23/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/57/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/73/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/629/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/719/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/724/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/759/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/20/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/143/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/681/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/720/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/44/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/707/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/19/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/727/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/728/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/755/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/13/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/257/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/750/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/214/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/195/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/28/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/645/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/721/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/746/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/15/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/714/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/745/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/722/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/345/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/704/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/733/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/747/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/754/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/42/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/9/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/30/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/35/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/56/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/710/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/711/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf File opened for reading /proc/3/cmdline b3de3366496648bc2020eaa49eae23354cf499fc846c5b3f479ea025ff34a4a3.elf