Analysis
-
max time kernel
135s -
max time network
147s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
21-12-2024 01:13
Behavioral task
behavioral1
Sample
d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf
Resource
debian9-armhf-20240418-en
debian-9-armhf
5 signatures
150 seconds
General
-
Target
d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf
-
Size
209KB
-
MD5
4528c59bd04bd8ec4cf3440685a609b9
-
SHA1
895498d902fec75311ab49b7743be541fb7c8bf4
-
SHA256
d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d
-
SHA512
89fb3ca4e65c5043544a5584807a1842d3e82e66a1363f650b5e6bd1cf7968a01a4a30d9c1a0120cfccad62fa51949e423af751c9f8a7d1ee8a7e1ec3a4ae571
-
SSDEEP
6144:GpBoH8NdRhPRJA8U3agD5tOHSAurbVEnCvCaM/RdhY:Ooc7RDJJU3aI5tOHlS5E0Cj//O
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 647 d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 645 d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf -
Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/637/stat ps File opened for reading /proc/638/stat ps File opened for reading /proc/642/status ps File opened for reading /proc/uptime ps File opened for reading /proc/meminfo ps File opened for reading /proc/4/stat ps File opened for reading /proc/12/stat ps File opened for reading /proc/27/cmdline ps File opened for reading /proc/149/cmdline ps File opened for reading /proc/207/stat ps File opened for reading /proc/323/status ps File opened for reading /proc/22228)/cmdline d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf File opened for reading /proc/2222�*/cmdline d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf File opened for reading /proc/12/cmdline ps File opened for reading /proc/17/cmdline ps File opened for reading /proc/144/status ps File opened for reading /proc/self/stat ps File opened for reading /proc/114/cmdline ps File opened for reading /proc/293/status ps File opened for reading /proc/313/status ps File opened for reading /proc/6666_3/cmdline d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf File opened for reading /proc/9/status ps File opened for reading /proc/115/status ps File opened for reading /proc/144/stat ps File opened for reading /proc/291/cmdline ps File opened for reading /proc/595/cmdline ps File opened for reading /proc/888s�"/cmdline d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf File opened for reading /proc/66666/cmdline d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf File opened for reading /proc/sys/kernel/pid_max ps File opened for reading /proc/15/cmdline ps File opened for reading /proc/20/status ps File opened for reading /proc/642/cmdline ps File opened for reading /proc/77/cmdline d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf File opened for reading /proc/649/cmdline ps File opened for reading /proc/650/stat ps File opened for reading /proc/27/stat ps File opened for reading /proc/29/status ps File opened for reading /proc/291/status ps File opened for reading /proc/316/status ps File opened for reading /proc/222�"/cmdline d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf File opened for reading /proc/81/cmdline ps File opened for reading /proc/600/status ps File opened for reading /proc/22229*/cmdline d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf File opened for reading /proc/145/status ps File opened for reading /proc/29/cmdline ps File opened for reading /proc/631/status ps File opened for reading /proc/637/status ps File opened for reading /proc/22/cmdline d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf File opened for reading /proc/222/cmdline d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf File opened for reading /proc/filesystems ps File opened for reading /proc/7/cmdline ps File opened for reading /proc/22/status ps File opened for reading /proc/25/cmdline ps File opened for reading /proc/227/stat ps File opened for reading /proc/280/status ps File opened for reading /proc/644/stat ps File opened for reading /proc/652/stat ps File opened for reading /proc/111c�"/cmdline d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf File opened for reading /proc/11/stat ps File opened for reading /proc/24/status ps File opened for reading /proc/291/stat ps File opened for reading /proc/310/cmdline ps File opened for reading /proc/99/cmdline d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf File opened for reading /proc/3333�3/cmdline d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf
Processes
-
/tmp/d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf/tmp/d8f8048861b5ea3320c47f44dbbc95037148ed46cba648ce6fdb3fd6f0dd0c4d.elf1⤵
- Deletes itself
- Changes its process name
- Reads runtime system information
PID:645 -
/bin/shsh -c "ps -e -o pid,args="2⤵PID:649
-
/bin/psps -e -o "pid,args="3⤵
- Reads CPU attributes
- Reads runtime system information
PID:650
-
-