Analysis
-
max time kernel
59s -
max time network
57s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
31-01-2025 10:34
Behavioral task
behavioral1
Sample
bot.arm7
Resource
debian9-armhf-20240729-en
debian-9-armhf
3 signatures
60 seconds
General
-
Target
bot.arm7
-
Size
180KB
-
MD5
df84af3499bcbfd212751bc10251314d
-
SHA1
ed71b33d82d823305fc5c53eeeba506658695c76
-
SHA256
92459513bb5128d8f3d817d9ff98fe1264a280626ac55142af4aaf89110ee74b
-
SHA512
6164cd9ac280d4e1c9f10f3455329bb8c9159e3c6be98098a89a17f2834e4004a540512fc87ac02fafe90b572bdc1bd96feaa1240b58235306ca785486c3f2ab
-
SSDEEP
3072:GaS4dN4ma1W9YHk9ah/QqXFgwakY7mo6ux/YpEoGM/R2kwwTNR:TSYN21W6E9ah/Qq1gB2ozx/yJGM/R2k3
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 646 bot.arm7 -
description ioc Process File opened for reading /proc/660/cmdline bot.arm7 File opened for reading /proc/665/cmdline bot.arm7 File opened for reading /proc/669/cmdline bot.arm7 File opened for reading /proc/692/cmdline bot.arm7 File opened for reading /proc/13/cmdline bot.arm7 File opened for reading /proc/280/cmdline bot.arm7 File opened for reading /proc/643/cmdline bot.arm7 File opened for reading /proc/647/cmdline bot.arm7 File opened for reading /proc/750/cmdline bot.arm7 File opened for reading /proc/694/cmdline bot.arm7 File opened for reading /proc/696/cmdline bot.arm7 File opened for reading /proc/745/cmdline bot.arm7 File opened for reading /proc/762/cmdline bot.arm7 File opened for reading /proc/12/cmdline bot.arm7 File opened for reading /proc/14/cmdline bot.arm7 File opened for reading /proc/292/cmdline bot.arm7 File opened for reading /proc/682/cmdline bot.arm7 File opened for reading /proc/114/cmdline bot.arm7 File opened for reading /proc/641/cmdline bot.arm7 File opened for reading /proc/709/cmdline bot.arm7 File opened for reading /proc/725/cmdline bot.arm7 File opened for reading /proc/753/cmdline bot.arm7 File opened for reading /proc/17/cmdline bot.arm7 File opened for reading /proc/277/cmdline bot.arm7 File opened for reading /proc/601/cmdline bot.arm7 File opened for reading /proc/742/cmdline bot.arm7 File opened for reading /proc/726/cmdline bot.arm7 File opened for reading /proc/728/cmdline bot.arm7 File opened for reading /proc/747/cmdline bot.arm7 File opened for reading /proc/749/cmdline bot.arm7 File opened for reading /proc/8/cmdline bot.arm7 File opened for reading /proc/661/cmdline bot.arm7 File opened for reading /proc/688/cmdline bot.arm7 File opened for reading /proc/691/cmdline bot.arm7 File opened for reading /proc/712/cmdline bot.arm7 File opened for reading /proc/727/cmdline bot.arm7 File opened for reading /proc/734/cmdline bot.arm7 File opened for reading /proc/227/cmdline bot.arm7 File opened for reading /proc/645/cmdline bot.arm7 File opened for reading /proc/684/cmdline bot.arm7 File opened for reading /proc/708/cmdline bot.arm7 File opened for reading /proc/718/cmdline bot.arm7 File opened for reading /proc/757/cmdline bot.arm7 File opened for reading /proc/766/cmdline bot.arm7 File opened for reading /proc/1/cmdline bot.arm7 File opened for reading /proc/2/cmdline bot.arm7 File opened for reading /proc/23/cmdline bot.arm7 File opened for reading /proc/702/cmdline bot.arm7 File opened for reading /proc/675/cmdline bot.arm7 File opened for reading /proc/746/cmdline bot.arm7 File opened for reading /proc/754/cmdline bot.arm7 File opened for reading /proc/43/cmdline bot.arm7 File opened for reading /proc/595/cmdline bot.arm7 File opened for reading /proc/666/cmdline bot.arm7 File opened for reading /proc/667/cmdline bot.arm7 File opened for reading /proc/739/cmdline bot.arm7 File opened for reading /proc/740/cmdline bot.arm7 File opened for reading /proc/761/cmdline bot.arm7 File opened for reading /proc/3/cmdline bot.arm7 File opened for reading /proc/24/cmdline bot.arm7 File opened for reading /proc/27/cmdline bot.arm7 File opened for reading /proc/704/cmdline bot.arm7 File opened for reading /proc/686/cmdline bot.arm7 File opened for reading /proc/760/cmdline bot.arm7