Analysis
-
max time kernel
150s -
max time network
151s -
platform
debian-12_armhf -
resource
debian12-armhf-20240418-en -
resource tags
arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
23-12-2024 02:07
Behavioral task
behavioral1
Sample
4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf
Resource
debian12-armhf-20240418-en
debian-12-armhf
3 signatures
150 seconds
General
-
Target
4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf
-
Size
180KB
-
MD5
1dda88dbd2c59d84714bc4ec05e23580
-
SHA1
94565d334d29e8f6a2210b4e1753f0c5e792851d
-
SHA256
4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133
-
SHA512
2306d5c0a0c074e3093e547066cddbb8a7983e59a40919042e2831e90195f9f73bd7a030553f9ccad202993eb13a72921b5eb34efe166e950952f50161585f81
-
SSDEEP
3072:5UStdNqma1W9YHk9ah/QqXFgwakY7mo6nx/YpEoGM/RhkwLTNN:qSnNE1W6E9ah/Qq1gB2o2x/yJGM/Rhku
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 702 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf -
description ioc Process File opened for reading /proc/24/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/751/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/6/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/143/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/256/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/324/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/742/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/10/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/13/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/22/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/23/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/4/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/718/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/756/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/716/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/195/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/629/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/746/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/752/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/2/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/14/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/187/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/194/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/57/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/700/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/56/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/221/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/317/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/701/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/17/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/20/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/722/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/724/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/9/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/27/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/30/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/748/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/42/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/345/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/645/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/727/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/744/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/8/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/46/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/708/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/741/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/29/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/32/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/736/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/753/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/311/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/739/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/747/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/749/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/715/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/720/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/729/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/735/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/726/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/730/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/7/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/353/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/706/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf File opened for reading /proc/719/cmdline 4635fa4a1b51aa255660ea65d35ae51fa9a010d563a78a39e3b6e3b19a70d133.elf