Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
23/12/2024, 02:14
Behavioral task
behavioral1
Sample
61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf
Resource
debian9-armhf-20240418-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf
-
Size
175KB
-
MD5
3cb7f09ee95355d0ecf9166d196a2005
-
SHA1
00b23ecc99df8164d128d033542730a326cb898d
-
SHA256
61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b
-
SHA512
5d7dbf2a88fcddcaf09cf224582a139f0951aa0e3b1e28314dbdd205f49e83d613ac3ff7a85a7e1ee263ad6474420fc766c30967c04e75d509079d29a653a3f4
-
SSDEEP
3072:3tbNtVjxrvAqTkYaDsh+OcAhf/HSwBjdo2nJ/o/wM/R8+n:3tdxr9oYaDsh+nAxRBBo2JgIM/R8+n
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself -"6 645 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf -
description ioc Process File opened for reading /proc/26/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/664/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/692/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/777/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/778/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/7/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/18/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/686/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/693/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/751/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/105/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/329/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/667/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/678/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/699/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/708/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/715/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/750/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/781/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/16/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/29/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/764/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/767/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/768/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/770/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/783/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/24/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/276/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/631/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/640/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/683/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/704/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/709/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/5/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/9/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/41/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/579/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/662/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/774/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/8/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/17/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/25/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/42/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/647/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/650/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/690/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/761/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/138/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/259/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/679/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/725/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/728/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/738/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/749/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/22/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/28/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/272/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/668/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/671/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/694/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/1/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/6/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/43/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf File opened for reading /proc/149/cmdline 61692b93323b0b8699080be55f00a7f8b08676cf78a2927a913794347f30892b.elf