Analysis
-
max time kernel
150s -
max time network
149s -
platform
debian-12_armhf -
resource
debian12-armhf-20240418-en -
resource tags
arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
29-12-2024 12:47
Behavioral task
behavioral1
Sample
bot.arm7.elf
Resource
debian12-armhf-20240418-en
debian-12-armhf
3 signatures
150 seconds
General
-
Target
bot.arm7.elf
-
Size
175KB
-
MD5
b48b9273165ad39ea0b08712084ed213
-
SHA1
517127d7eae5086aee2dba7b6733b3bcf4555258
-
SHA256
882bd6dca0b3b39ff64fdb5b814717a5d448ecc36ecf90062246a6d585b87f28
-
SHA512
2afd7678c702b5ff02a0246694acee4c4b8368ac5243cfd695c11bbe617e7f4da05840681acf813ba35842a2a48408ada68106ec731d18a74de91946e12c57dc
-
SSDEEP
3072:6N/msnezlTERakAajYFyisk5ybXCUBpv4/hJjogM/RnyOGN:6N/SlT89AajYFybkAZBB4/XMgM/RnyOC
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 702 bot.arm7.elf -
description ioc Process File opened for reading /proc/30/cmdline bot.arm7.elf File opened for reading /proc/35/cmdline bot.arm7.elf File opened for reading /proc/142/cmdline bot.arm7.elf File opened for reading /proc/325/cmdline bot.arm7.elf File opened for reading /proc/741/cmdline bot.arm7.elf File opened for reading /proc/12/cmdline bot.arm7.elf File opened for reading /proc/322/cmdline bot.arm7.elf File opened for reading /proc/340/cmdline bot.arm7.elf File opened for reading /proc/706/cmdline bot.arm7.elf File opened for reading /proc/718/cmdline bot.arm7.elf File opened for reading /proc/728/cmdline bot.arm7.elf File opened for reading /proc/46/cmdline bot.arm7.elf File opened for reading /proc/7/cmdline bot.arm7.elf File opened for reading /proc/13/cmdline bot.arm7.elf File opened for reading /proc/23/cmdline bot.arm7.elf File opened for reading /proc/4/cmdline bot.arm7.elf File opened for reading /proc/736/cmdline bot.arm7.elf File opened for reading /proc/662/cmdline bot.arm7.elf File opened for reading /proc/25/cmdline bot.arm7.elf File opened for reading /proc/643/cmdline bot.arm7.elf File opened for reading /proc/1/cmdline bot.arm7.elf File opened for reading /proc/33/cmdline bot.arm7.elf File opened for reading /proc/8/cmdline bot.arm7.elf File opened for reading /proc/34/cmdline bot.arm7.elf File opened for reading /proc/213/cmdline bot.arm7.elf File opened for reading /proc/681/cmdline bot.arm7.elf File opened for reading /proc/708/cmdline bot.arm7.elf File opened for reading /proc/17/cmdline bot.arm7.elf File opened for reading /proc/710/cmdline bot.arm7.elf File opened for reading /proc/740/cmdline bot.arm7.elf File opened for reading /proc/753/cmdline bot.arm7.elf File opened for reading /proc/9/cmdline bot.arm7.elf File opened for reading /proc/717/cmdline bot.arm7.elf File opened for reading /proc/724/cmdline bot.arm7.elf File opened for reading /proc/751/cmdline bot.arm7.elf File opened for reading /proc/2/cmdline bot.arm7.elf File opened for reading /proc/51/cmdline bot.arm7.elf File opened for reading /proc/677/cmdline bot.arm7.elf File opened for reading /proc/735/cmdline bot.arm7.elf File opened for reading /proc/44/cmdline bot.arm7.elf File opened for reading /proc/635/cmdline bot.arm7.elf File opened for reading /proc/705/cmdline bot.arm7.elf File opened for reading /proc/712/cmdline bot.arm7.elf File opened for reading /proc/737/cmdline bot.arm7.elf File opened for reading /proc/745/cmdline bot.arm7.elf File opened for reading /proc/310/cmdline bot.arm7.elf File opened for reading /proc/18/cmdline bot.arm7.elf File opened for reading /proc/19/cmdline bot.arm7.elf File opened for reading /proc/187/cmdline bot.arm7.elf File opened for reading /proc/727/cmdline bot.arm7.elf File opened for reading /proc/750/cmdline bot.arm7.elf File opened for reading /proc/3/cmdline bot.arm7.elf File opened for reading /proc/16/cmdline bot.arm7.elf File opened for reading /proc/42/cmdline bot.arm7.elf File opened for reading /proc/337/cmdline bot.arm7.elf File opened for reading /proc/713/cmdline bot.arm7.elf File opened for reading /proc/719/cmdline bot.arm7.elf File opened for reading /proc/5/cmdline bot.arm7.elf File opened for reading /proc/257/cmdline bot.arm7.elf File opened for reading /proc/704/cmdline bot.arm7.elf File opened for reading /proc/725/cmdline bot.arm7.elf File opened for reading /proc/32/cmdline bot.arm7.elf File opened for reading /proc/317/cmdline bot.arm7.elf File opened for reading /proc/354/cmdline bot.arm7.elf