e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7

Analysis

max time kernel
138s
max time network
161s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
29-12-2024 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7.elf
Size

211KB
MD5

fe01e8fc0efa451ac06c7f5dd81bae4e
SHA1

acdeffd6f7f0ed3557c9b233749d6dd91abac905
SHA256

e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7
SHA512

e1ea3c0a73dafca19dcbaed677ee975b1660d08ca4cb3c0ba1412d32269e5d0be4b06d82440197b42c9c3b53c2f4d7e70e7360f4d7db9dc84776626e31cdabfd
SSDEEP

6144:FLziNEEQ/E8OFR3h0sEiaUVB1ILe6uuQdtEwvSw0M/RnPzdcY:F6NHMTc39EiaaB1ILXPgEdwJ/FPzd5

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
711	e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7.elf

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	httpd	708	e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/143/status	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/46/status	ps
File opened for reading	/proc/705/environ	ps
File opened for reading	/proc/706/stat	ps
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/2/status	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/28/cmdline	ps
File opened for reading	/proc/44/environ	ps
File opened for reading	/proc/340/status	ps
File opened for reading	/proc/705/status	ps
File opened for reading	/proc/320/cmdline	ps
File opened for reading	/proc/222v�/cmdline	e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7.elf
File opened for reading	/proc/7777/cmdline	e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7.elf
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/18/cmdline	ps
File opened for reading	/proc/32/stat	ps
File opened for reading	/proc/142/status	ps
File opened for reading	/proc/213/environ	ps
File opened for reading	/proc/3333fffffff/cmdline	e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7.elf
File opened for reading	/proc/6666�7/cmdline	e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7.elf
File opened for reading	/proc/340/environ	ps
File opened for reading	/proc/677/status	ps
File opened for reading	/proc/1/cmdline	ps
File opened for reading	/proc/34/environ	ps
File opened for reading	/proc/46/environ	ps
File opened for reading	/proc/143/cmdline	ps
File opened for reading	/proc/186/cmdline	ps
File opened for reading	/proc/333/stat	ps
File opened for reading	/proc/348/cmdline	ps
File opened for reading	/proc/1111.;/cmdline	e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7.elf
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/32/status	ps
File opened for reading	/proc/342/environ	ps
File opened for reading	/proc/7777:;/cmdline	e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7.elf
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/344/cmdline	ps
File opened for reading	/proc/716/cmdline	ps
File opened for reading	/proc/718/status	ps
File opened for reading	/proc/111/cmdline	e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7.elf
File opened for reading	/proc/444/cmdline	e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7.elf
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/25/cmdline	ps
File opened for reading	/proc/555/cmdline	e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7.elf
File opened for reading	/proc/26/stat	ps
File opened for reading	/proc/143/stat	ps
File opened for reading	/proc/186/stat	ps
File opened for reading	/proc/716/status	ps
File opened for reading	/proc/348/stat	ps
File opened for reading	/proc/678/environ	ps
File opened for reading	/proc/1111-;/cmdline	e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7.elf
File opened for reading	/proc/2/environ	ps
File opened for reading	/proc/8/cmdline	ps
File opened for reading	/proc/645/status	ps
File opened for reading	/proc/709/status	ps
File opened for reading	/proc/712/cmdline	ps
File opened for reading	/proc/11/environ	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/255/environ	ps
File opened for reading	/proc/340/stat	ps

/tmp/e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7.elf
/tmp/e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7.elf
1⤵
- Deletes itself
- Changes its process name
- Reads runtime system information
PID:708
- /bin/sh
  sh -c "ps -e -o pid,args="
  2⤵
  PID:714
- - /usr/bin/ps
    ps -e -o "pid,args="
    3⤵
    - Reads runtime system information
    PID:716

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads