Analysis
-
max time kernel
150s -
max time network
153s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240226-en -
resource tags
arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
27-12-2024 01:07
Behavioral task
behavioral1
Sample
b7d7dec1104c329f336e7e4b9bd73bcb99da0d7a356c46358f139c3d4c35bf6d.elf
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
4 signatures
150 seconds
General
-
Target
b7d7dec1104c329f336e7e4b9bd73bcb99da0d7a356c46358f139c3d4c35bf6d.elf
-
Size
173KB
-
MD5
32051911d97ddd88db0e8b1b2f192cf5
-
SHA1
b5f5ba092e07f64002b20089676e9822b57bfcd3
-
SHA256
b7d7dec1104c329f336e7e4b9bd73bcb99da0d7a356c46358f139c3d4c35bf6d
-
SHA512
4cfa696b7a277bc648846003c0c6ccb1e5eba2e44d4625f29791cb1ba7ce42016cc4b67d4508d560303899f9aa0e2c1e273da70f7d42d9257b02abea1294da41
-
SSDEEP
3072:nKpzGteNkSfcQqmav8SqaRVlnYz65CVt:nKYteNYQqmeqavlg65C
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 709 b7d7dec1104c329f336e7e4b9bd73bcb99da0d7a356c46358f139c3d4c35bf6d.elf -
Traces itself 2 IoCs
Traces itself to prevent debugging attempts
pid Process 709 b7d7dec1104c329f336e7e4b9bd73bcb99da0d7a356c46358f139c3d4c35bf6d.elf 710 b7d7dec1104c329f336e7e4b9bd73bcb99da0d7a356c46358f139c3d4c35bf6d.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 709 b7d7dec1104c329f336e7e4b9bd73bcb99da0d7a356c46358f139c3d4c35bf6d.elf -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/b7d7dec1104c329f336e7e4b9bd73bcb99da0d7a356c46358f139c3d4c35bf6d.elf b7d7dec1104c329f336e7e4b9bd73bcb99da0d7a356c46358f139c3d4c35bf6d.elf