Analysis
-
max time kernel
133s -
max time network
148s -
platform
debian-12_armhf -
resource
debian12-armhf-20240729-en -
resource tags
arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
02-01-2025 06:57
Behavioral task
behavioral1
Sample
ivwebcda7.elf
Resource
debian12-armhf-20240729-en
debian-12-armhf
3 signatures
150 seconds
General
-
Target
ivwebcda7.elf
-
Size
207KB
-
MD5
feb836b565aa6eb913c9919f942618d8
-
SHA1
ae58955f42ca4a0c8caefcddd36224f8fbbfb426
-
SHA256
b8f563125ea97a9b9a74627ac8c315a962a48a76881bc6c430ece8a560a87f8e
-
SHA512
07cdc31d8530c6c69c426b3dce300e5218d6acf52084a0ead9ba11a91af7b7764c660c7630dbae3acf4916a50221acdd90223eec02968f13ca3648c4134db4cc
-
SSDEEP
6144:ISeqMLllawJoqhZaTBnlqSAgWRKiOHEJ2M/RAu7kLd:ICMR37hZaNnlqSf45FJv/exB
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 708 ivwebcda7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 705 ivwebcda7.elf -
description ioc Process File opened for reading /proc/6666�7/cmdline ivwebcda7.elf File opened for reading /proc/7777;/cmdline ivwebcda7.elf File opened for reading /proc/11/cmdline ivwebcda7.elf File opened for reading /proc/444d�/cmdline ivwebcda7.elf File opened for reading /proc/3333 ;/cmdline ivwebcda7.elf File opened for reading /proc/7777/cmdline ivwebcda7.elf File opened for reading /proc/333/cmdline ivwebcda7.elf File opened for reading /proc/6666�:/stat ivwebcda7.elf File opened for reading /proc/1111;/stat ivwebcda7.elf File opened for reading /proc/3333o5/cmdline ivwebcda7.elf File opened for reading /proc/6666�7/stat ivwebcda7.elf File opened for reading /proc/2222;/cmdline ivwebcda7.elf File opened for reading /proc/333s�/cmdline ivwebcda7.elf File opened for reading /proc/6666�8/cmdline ivwebcda7.elf File opened for reading /proc/7777;/stat ivwebcda7.elf File opened for reading /proc/7777";/stat ivwebcda7.elf File opened for reading /proc/222c�/cmdline ivwebcda7.elf File opened for reading /proc/333/stat ivwebcda7.elf File opened for reading /proc/6666;/stat ivwebcda7.elf File opened for reading /proc/7777�:/stat ivwebcda7.elf File opened for reading /proc/55/cmdline ivwebcda7.elf File opened for reading /proc/222|/cmdline ivwebcda7.elf File opened for reading /proc/333s�/cmdline ivwebcda7.elf File opened for reading /proc/222�/stat ivwebcda7.elf File opened for reading /proc/22/cmdline ivwebcda7.elf File opened for reading /proc/111r/stat ivwebcda7.elf File opened for reading /proc/1111�/stat ivwebcda7.elf File opened for reading /proc/7777;/stat ivwebcda7.elf File opened for reading /proc/7777;/stat ivwebcda7.elf File opened for reading /proc/6666�:/cmdline ivwebcda7.elf File opened for reading /proc/222|/stat ivwebcda7.elf File opened for reading /proc/222l�/stat ivwebcda7.elf File opened for reading /proc/33/stat ivwebcda7.elf File opened for reading /proc/222m�/stat ivwebcda7.elf File opened for reading /proc/7777�:/stat ivwebcda7.elf File opened for reading /proc/1111;/cmdline ivwebcda7.elf File opened for reading /proc/444/cmdline ivwebcda7.elf File opened for reading /proc/2222�3/cmdline ivwebcda7.elf File opened for reading /proc/111cz/stat ivwebcda7.elf File opened for reading /proc/3333D5/stat ivwebcda7.elf File opened for reading /proc/111cx/cmdline ivwebcda7.elf File opened for reading /proc/111h/cmdline ivwebcda7.elf File opened for reading /proc/111r/cmdline ivwebcda7.elf File opened for reading /proc/7777�:/cmdline ivwebcda7.elf File opened for reading /proc/7777;/cmdline ivwebcda7.elf File opened for reading /proc/555/stat ivwebcda7.elf File opened for reading /proc/3333 ;/stat ivwebcda7.elf File opened for reading /proc/66/cmdline ivwebcda7.elf File opened for reading /proc/222v�/cmdline ivwebcda7.elf File opened for reading /proc/555s�/cmdline ivwebcda7.elf File opened for reading /proc/1111S0/cmdline ivwebcda7.elf File opened for reading /proc/33335/cmdline ivwebcda7.elf File opened for reading /proc/3333�4/stat ivwebcda7.elf File opened for reading /proc/111/cmdline ivwebcda7.elf File opened for reading /proc/3333�4/cmdline ivwebcda7.elf File opened for reading /proc/11/stat ivwebcda7.elf File opened for reading /proc/7777�:/cmdline ivwebcda7.elf File opened for reading /proc/55/stat ivwebcda7.elf File opened for reading /proc/222/stat ivwebcda7.elf File opened for reading /proc/333�/stat ivwebcda7.elf File opened for reading /proc/2222fffffff/stat ivwebcda7.elf File opened for reading /proc/3333�4/cmdline ivwebcda7.elf File opened for reading /proc/7777;/cmdline ivwebcda7.elf File opened for reading /proc/6666;/stat ivwebcda7.elf