Analysis

  • max time kernel
    132s
  • max time network
    164s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20240221-en
  • resource tags

    arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    20-12-2024 06:40

General

  • Target

    d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf

  • Size

    209KB

  • MD5

    4528c59bd04bd8ec4cf3440685a609b9

  • SHA1

    895498d902fec75311ab49b7743be541fb7c8bf4

  • SHA256

    d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d

  • SHA512

    89fb3ca4e65c5043544a5584807a1842d3e82e66a1363f650b5e6bd1cf7968a01a4a30d9c1a0120cfccad62fa51949e423af751c9f8a7d1ee8a7e1ec3a4ae571

  • SSDEEP

    6144:GpBoH8NdRhPRJA8U3agD5tOHSAurbVEnCvCaM/RdhY:Ooc7RDJJU3aI5tOHlS5E0Cj//O

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf
    /tmp/d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf
    1⤵
    • Deletes itself
    • Changes its process name
    • Reads runtime system information
    PID:717
    • /bin/sh
      sh -c "ps -e -o pid,args="
      2⤵
        PID:734
        • /usr/bin/ps
          ps -e -o "pid,args="
          3⤵
          • Reads runtime system information
          PID:738

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads