Analysis
-
max time kernel
150s -
max time network
149s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
23-12-2024 02:05
Behavioral task
behavioral1
Sample
330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf
-
Size
130KB
-
MD5
a62d2137160a6f4f960378d4f6c6060d
-
SHA1
82cac2aac88a30d3e90f661fd3456a630e05e704
-
SHA256
330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9
-
SHA512
d9a85b58bd844ea79cda51c4a8829d639c2b009db2f4f704de27fc1f09acdf1a7e208f78820d35bfa42a8253bb72369246f4fcaf0fc06aa7eddd9e2928c55201
-
SSDEEP
1536:Q/ZcFm6X+a866G9iYkGFZAuUX4VfirZTrklRsV9K7AP0xhvltEZwywJFdmI547tn:Q/Zml37FZW4k9PklRsaEcx65B6jw
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself -"6 657 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf -
description ioc Process File opened for reading /proc/24/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/278/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/656/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/663/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/736/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/6/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/643/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/655/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/715/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/720/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/779/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/783/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/790/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/23/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/21/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/667/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/673/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/675/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/685/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/703/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/717/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/8/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/729/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/650/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/735/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/774/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/15/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/763/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/765/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/771/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/782/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/19/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/43/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/719/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/748/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/766/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/42/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/114/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/175/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/670/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/769/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/775/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/12/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/678/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/695/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/659/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/693/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/696/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/702/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/726/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/747/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/755/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/776/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/22/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/612/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/649/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/711/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/739/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/742/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/16/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/682/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/712/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/724/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf File opened for reading /proc/727/cmdline 330329bfb63ab66dfe27f0e9f240ece05b51d87458f7cb85349c57d7ec48c7b9.elf