Analysis
-
max time kernel
149s -
max time network
147s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
28-01-2025 15:07
Behavioral task
behavioral1
Sample
efefa7.elf
Resource
debian9-armhf-20240729-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
efefa7.elf
-
Size
161KB
-
MD5
ffdde8a8f2592766828b8b6da33b3d7a
-
SHA1
414d7fb81f5937ac61de4bfc06009d73853afab7
-
SHA256
d5e7b12a71d1e7cdb5f9b5e6b18325fd6389584680903f11607cf4aca59057ca
-
SHA512
92276fb07a9048e7641b369991993e7b0a195066a842a186f43a3f559abe7339c8f9800fddbfd1cccc3fbfa101022737c530dd0cd28e04d027c0daf5eddcaa11
-
SSDEEP
3072:FvmgII1T1mUaFtbDhKjrxxg3WQbM4ofLH66zM/94ZqV/:FvmgIIh0UaFtbDhKHxgW8M4ofLHxM/99
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 670 efefa7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 669 efefa7.elf -
description ioc Process File opened for reading /proc/6666�4/stat efefa7.elf File opened for reading /proc/6666�4/cmdline efefa7.elf File opened for reading /proc/6666k9/stat efefa7.elf File opened for reading /proc/44/cmdline efefa7.elf File opened for reading /proc/1111�"/cmdline efefa7.elf File opened for reading /proc/1111Q4/cmdline efefa7.elf File opened for reading /proc/77775/cmdline efefa7.elf File opened for reading /proc/6666k9/cmdline efefa7.elf File opened for reading /proc/2222j*/stat efefa7.elf File opened for reading /proc/3333,+/stat efefa7.elf File opened for reading /proc/6666W4/stat efefa7.elf File opened for reading /proc/6666L4/cmdline efefa7.elf File opened for reading /proc/1111R4/stat efefa7.elf File opened for reading /proc/111m�"/cmdline efefa7.elf File opened for reading /proc/3333,+/cmdline efefa7.elf File opened for reading /proc/3333�,/cmdline efefa7.elf File opened for reading /proc/7777�5/cmdline efefa7.elf File opened for reading /proc/222/cmdline efefa7.elf File opened for reading /proc/7777�5/cmdline efefa7.elf File opened for reading /proc/77776/cmdline efefa7.elf File opened for reading /proc/88ll�"/stat efefa7.elf File opened for reading /proc/77775/cmdline efefa7.elf File opened for reading /proc/66664/stat efefa7.elf File opened for reading /proc/7777�6/stat efefa7.elf File opened for reading /proc/7777�7/stat efefa7.elf File opened for reading /proc/5555�/stat efefa7.elf File opened for reading /proc/6666 5/cmdline efefa7.elf File opened for reading /proc/88882/stat efefa7.elf File opened for reading /proc/7777�6/cmdline efefa7.elf File opened for reading /proc/1111�"/stat efefa7.elf File opened for reading /proc/3333T4/stat efefa7.elf File opened for reading /proc/6666 5/stat efefa7.elf File opened for reading /proc/66662/stat efefa7.elf File opened for reading /proc/1111;)/cmdline efefa7.elf File opened for reading /proc/6666�3/cmdline efefa7.elf File opened for reading /proc/3333�,/stat efefa7.elf File opened for reading /proc/66/stat efefa7.elf File opened for reading /proc/7777�5/stat efefa7.elf File opened for reading /proc/7777�5/stat efefa7.elf File opened for reading /proc/6666�7/cmdline efefa7.elf File opened for reading /proc/6666�4/cmdline efefa7.elf File opened for reading /proc/777746/stat efefa7.elf File opened for reading /proc/7777�6/cmdline efefa7.elf File opened for reading /proc/6666�9/stat efefa7.elf File opened for reading /proc/3333b+/stat efefa7.elf File opened for reading /proc/3333�,/stat efefa7.elf File opened for reading /proc/6666H7/stat efefa7.elf File opened for reading /proc/7777*5/cmdline efefa7.elf File opened for reading /proc/7777�5/stat efefa7.elf File opened for reading /proc/6666�8/cmdline efefa7.elf File opened for reading /proc/222i�"/cmdline efefa7.elf File opened for reading /proc/222s�"/cmdline efefa7.elf File opened for reading /proc/222v�"/cmdline efefa7.elf File opened for reading /proc/77776/cmdline efefa7.elf File opened for reading /proc/6666V4/stat efefa7.elf File opened for reading /proc/7777*5/stat efefa7.elf File opened for reading /proc/222/stat efefa7.elf File opened for reading /proc/1111�"/stat efefa7.elf File opened for reading /proc/3333�,/stat efefa7.elf File opened for reading /proc/7777�6/stat efefa7.elf File opened for reading /proc/88882/cmdline efefa7.elf File opened for reading /proc/6666�4/cmdline efefa7.elf File opened for reading /proc/7777J6/stat efefa7.elf File opened for reading /proc/7777~6/cmdline efefa7.elf