Analysis
-
max time kernel
150s -
max time network
143s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
24-12-2024 00:09
Behavioral task
behavioral1
Sample
bot.arm.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
bot.arm.elf
-
Size
134KB
-
MD5
ac277ab772bcf5e631087de018213b1d
-
SHA1
b02bd2f706dd8d9654a66c91439ce5953ae9c912
-
SHA256
2b9fd371dba5865cecabcfc60d31cf39e5da0808586748aa272327f2ca50ecc9
-
SHA512
14878c7f9c52d221555ca1ac8e1b1850e3a9a57037448f73710f64f4f316119627088e1c6caa512f7a3b568b1520bc448ffa5bdf2a8363280fe85d8c033ebe68
-
SSDEEP
1536:DeIIcq87ZO8VQzlHai3UAGXlFFAeSz4VAZJsTgVYYgBna2/AbdjlifIwywmFfb1O:CIIifY3UVVFFM4UiMVYYgnobKZGvQd
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 652 bot.arm.elf -
description ioc Process File opened for reading /proc/703/cmdline bot.arm.elf File opened for reading /proc/713/cmdline bot.arm.elf File opened for reading /proc/755/cmdline bot.arm.elf File opened for reading /proc/756/cmdline bot.arm.elf File opened for reading /proc/7/cmdline bot.arm.elf File opened for reading /proc/20/cmdline bot.arm.elf File opened for reading /proc/27/cmdline bot.arm.elf File opened for reading /proc/138/cmdline bot.arm.elf File opened for reading /proc/758/cmdline bot.arm.elf File opened for reading /proc/780/cmdline bot.arm.elf File opened for reading /proc/718/cmdline bot.arm.elf File opened for reading /proc/721/cmdline bot.arm.elf File opened for reading /proc/754/cmdline bot.arm.elf File opened for reading /proc/12/cmdline bot.arm.elf File opened for reading /proc/107/cmdline bot.arm.elf File opened for reading /proc/160/cmdline bot.arm.elf File opened for reading /proc/696/cmdline bot.arm.elf File opened for reading /proc/681/cmdline bot.arm.elf File opened for reading /proc/700/cmdline bot.arm.elf File opened for reading /proc/708/cmdline bot.arm.elf File opened for reading /proc/726/cmdline bot.arm.elf File opened for reading /proc/17/cmdline bot.arm.elf File opened for reading /proc/25/cmdline bot.arm.elf File opened for reading /proc/28/cmdline bot.arm.elf File opened for reading /proc/653/cmdline bot.arm.elf File opened for reading /proc/707/cmdline bot.arm.elf File opened for reading /proc/777/cmdline bot.arm.elf File opened for reading /proc/772/cmdline bot.arm.elf File opened for reading /proc/277/cmdline bot.arm.elf File opened for reading /proc/694/cmdline bot.arm.elf File opened for reading /proc/705/cmdline bot.arm.elf File opened for reading /proc/736/cmdline bot.arm.elf File opened for reading /proc/16/cmdline bot.arm.elf File opened for reading /proc/592/cmdline bot.arm.elf File opened for reading /proc/666/cmdline bot.arm.elf File opened for reading /proc/714/cmdline bot.arm.elf File opened for reading /proc/6/cmdline bot.arm.elf File opened for reading /proc/42/cmdline bot.arm.elf File opened for reading /proc/729/cmdline bot.arm.elf File opened for reading /proc/682/cmdline bot.arm.elf File opened for reading /proc/724/cmdline bot.arm.elf File opened for reading /proc/739/cmdline bot.arm.elf File opened for reading /proc/740/cmdline bot.arm.elf File opened for reading /proc/5/cmdline bot.arm.elf File opened for reading /proc/14/cmdline bot.arm.elf File opened for reading /proc/599/cmdline bot.arm.elf File opened for reading /proc/679/cmdline bot.arm.elf File opened for reading /proc/743/cmdline bot.arm.elf File opened for reading /proc/749/cmdline bot.arm.elf File opened for reading /proc/669/cmdline bot.arm.elf File opened for reading /proc/672/cmdline bot.arm.elf File opened for reading /proc/725/cmdline bot.arm.elf File opened for reading /proc/753/cmdline bot.arm.elf File opened for reading /proc/75/cmdline bot.arm.elf File opened for reading /proc/270/cmdline bot.arm.elf File opened for reading /proc/272/cmdline bot.arm.elf File opened for reading /proc/600/cmdline bot.arm.elf File opened for reading /proc/773/cmdline bot.arm.elf File opened for reading /proc/730/cmdline bot.arm.elf File opened for reading /proc/748/cmdline bot.arm.elf File opened for reading /proc/760/cmdline bot.arm.elf File opened for reading /proc/778/cmdline bot.arm.elf File opened for reading /proc/8/cmdline bot.arm.elf File opened for reading /proc/10/cmdline bot.arm.elf