Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
26-12-2024 02:20
Behavioral task
behavioral1
Sample
aff97601f7d2f51e21960f89f7954081516339ee587ecf85e817de97794e3017.elf
Resource
debian9-mipsbe-20240729-en
debian-9-mips
4 signatures
150 seconds
General
-
Target
aff97601f7d2f51e21960f89f7954081516339ee587ecf85e817de97794e3017.elf
-
Size
169KB
-
MD5
c358b475eecf7fdf353e061af161673c
-
SHA1
abde77a6086200bb1a2345b0c537d946d6110f6a
-
SHA256
aff97601f7d2f51e21960f89f7954081516339ee587ecf85e817de97794e3017
-
SHA512
8a080a0071b5dc734b00ee7f5e01ba17624b1d38a4a98c34d7213270e8c88e23f04e4c2e879a2a046bc13d72a104292be6f39bff7b86e65117508eb0aa4b1ca1
-
SSDEEP
3072:jg57R+7LHZwbq1YSBan1yvbysxr1uGS8I:jglR+7LHZ0Bqyy1BS8I
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 726 aff97601f7d2f51e21960f89f7954081516339ee587ecf85e817de97794e3017.elf -
Traces itself 2 IoCs
Traces itself to prevent debugging attempts
pid Process 726 aff97601f7d2f51e21960f89f7954081516339ee587ecf85e817de97794e3017.elf 727 aff97601f7d2f51e21960f89f7954081516339ee587ecf85e817de97794e3017.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 726 aff97601f7d2f51e21960f89f7954081516339ee587ecf85e817de97794e3017.elf -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/aff97601f7d2f51e21960f89f7954081516339ee587ecf85e817de97794e3017.elf aff97601f7d2f51e21960f89f7954081516339ee587ecf85e817de97794e3017.elf