Analysis
-
max time kernel
133s -
max time network
159s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
06-01-2025 23:27
Behavioral task
behavioral1
Sample
ivwebcda7.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
ivwebcda7.elf
-
Size
157KB
-
MD5
bd2d24ce1eb83fac748d764cf89e7463
-
SHA1
bdd55ed25b7327000bb98f39221b1359eca681d6
-
SHA256
862faabcd28e4f3f253e12bcc03566f6a612af9abe9ac609c74c06ce7bc86e6e
-
SHA512
76424baebf536976a9b58cfca0a30f144f4cb051a0bb267b89281b394f2c555c3737ab913633cc0c03bdf5bca1c69b8b46474e9a7bd792feb62eb51ab0050034
-
SSDEEP
3072:vz6SmRl1T1mUayNbDhKwCx1g3W8WM7XaOSpqM/90UQbbVe:76SmRlh0UayNbDhKLx8W1M7XaOSkM/9H
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 657 ivwebcda7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 656 ivwebcda7.elf -
description ioc Process File opened for reading /proc/66660/stat ivwebcda7.elf File opened for reading /proc/222s�"/cmdline ivwebcda7.elf File opened for reading /proc/1111�"/cmdline ivwebcda7.elf File opened for reading /proc/666684/cmdline ivwebcda7.elf File opened for reading /proc/444s�"/stat ivwebcda7.elf File opened for reading /proc/5555�/stat ivwebcda7.elf File opened for reading /proc/6666(4/stat ivwebcda7.elf File opened for reading /proc/2222�,/cmdline ivwebcda7.elf File opened for reading /proc/66665/cmdline ivwebcda7.elf File opened for reading /proc/111/stat ivwebcda7.elf File opened for reading /proc/888s�"/cmdline ivwebcda7.elf File opened for reading /proc/6666F3/cmdline ivwebcda7.elf File opened for reading /proc/111144/stat ivwebcda7.elf File opened for reading /proc/111154/stat ivwebcda7.elf File opened for reading /proc/2222O*/stat ivwebcda7.elf File opened for reading /proc/111134/cmdline ivwebcda7.elf File opened for reading /proc/111�"/stat ivwebcda7.elf File opened for reading /proc/222�"/stat ivwebcda7.elf File opened for reading /proc/1111�%/cmdline ivwebcda7.elf File opened for reading /proc/2222O*/cmdline ivwebcda7.elf File opened for reading /proc/222�"/stat ivwebcda7.elf File opened for reading /proc/6666;4/cmdline ivwebcda7.elf File opened for reading /proc/55/stat ivwebcda7.elf File opened for reading /proc/666684/stat ivwebcda7.elf File opened for reading /proc/111c�"/cmdline ivwebcda7.elf File opened for reading /proc/6666B0/cmdline ivwebcda7.elf File opened for reading /proc/1111�%/stat ivwebcda7.elf File opened for reading /proc/222i�"/cmdline ivwebcda7.elf File opened for reading /proc/444s�"/cmdline ivwebcda7.elf File opened for reading /proc/2222�*/cmdline ivwebcda7.elf File opened for reading /proc/222/cmdline ivwebcda7.elf File opened for reading /proc/222�"/cmdline ivwebcda7.elf File opened for reading /proc/66/cmdline ivwebcda7.elf File opened for reading /proc/22/stat ivwebcda7.elf File opened for reading /proc/3333�,/stat ivwebcda7.elf File opened for reading /proc/1111�(/stat ivwebcda7.elf File opened for reading /proc/6666B0/stat ivwebcda7.elf File opened for reading /proc/1111�"/stat ivwebcda7.elf File opened for reading /proc/2222�*/stat ivwebcda7.elf File opened for reading /proc/6666<4/stat ivwebcda7.elf File opened for reading /proc/2222y+/cmdline ivwebcda7.elf File opened for reading /proc/333364/cmdline ivwebcda7.elf File opened for reading /proc/3333�,/cmdline ivwebcda7.elf File opened for reading /proc/111c�"/stat ivwebcda7.elf File opened for reading /proc/222v�"/cmdline ivwebcda7.elf File opened for reading /proc/1111�(/cmdline ivwebcda7.elf File opened for reading /proc/666694/cmdline ivwebcda7.elf File opened for reading /proc/1111�"/stat ivwebcda7.elf File opened for reading /proc/111124/stat ivwebcda7.elf File opened for reading /proc/22/cmdline ivwebcda7.elf File opened for reading /proc/1111�"/cmdline ivwebcda7.elf File opened for reading /proc/66660/cmdline ivwebcda7.elf File opened for reading /proc/333374/stat ivwebcda7.elf File opened for reading /proc/11/cmdline ivwebcda7.elf File opened for reading /proc/6666H0/cmdline ivwebcda7.elf File opened for reading /proc/222l�"/stat ivwebcda7.elf File opened for reading /proc/99/cmdline ivwebcda7.elf File opened for reading /proc/2222+/cmdline ivwebcda7.elf File opened for reading /proc/222s�"/stat ivwebcda7.elf File opened for reading /proc/111m�"/stat ivwebcda7.elf File opened for reading /proc/111c�"/stat ivwebcda7.elf File opened for reading /proc/111134/stat ivwebcda7.elf File opened for reading /proc/111114/cmdline ivwebcda7.elf File opened for reading /proc/222v�"/stat ivwebcda7.elf