Analysis
- max time kernel
133s - max time network
151s - platform
debian-9_armhf - resource
debian9-armhf-20240611-en - resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
05/03/2025, 12:26
Behavioral task
behavioral1
Sample
vejfa5.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
4 signatures
150 seconds
General
- Target vejfa5.elf
- Size 142KB
- Sample250305-pmbq7sysft
- SHA256 07aa61d6d46d87cefd1151cf9ec56fe6d86122e89e9b9e398e55d5f814be30e1
- MD5 91cdb7dbf660e36dfaf014394e1e46ac
- SHA1 40804786a4fb3bc378a7611d32c6e175918b0f79
- SHA512 53342a269e39a299e2d980c4572e5243b8f62237d7d9e12fcd7754d5cd65c926f348ac2ecf9059cd947afeb428cc321d1f11d2efcf149b27d3e21dbd47ac7335
- SSDEEP 1536:hQC3lbc/cpRH9DCBMN8Pc5l2pEnfe4VpdRkTuTApvLvxOF8AyjO4pqTEllJwyws5:hQCu/0Hdb5lW4TkSTApzeMOsooZYoKM
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 653 vejfa5.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 652 vejfa5.elf -
description ioc Process File opened for reading /proc/11/stat vejfa5.elf File opened for reading /proc/95/stat vejfa5.elf File opened for reading /proc/106/stat vejfa5.elf File opened for reading /proc/749/stat vejfa5.elf File opened for reading /proc/848/stat vejfa5.elf File opened for reading /proc/919/stat vejfa5.elf File opened for reading /proc/987/stat vejfa5.elf File opened for reading /proc/402/stat vejfa5.elf File opened for reading /proc/43/stat vejfa5.elf File opened for reading /proc/265/stat vejfa5.elf File opened for reading /proc/834/stat vejfa5.elf File opened for reading /proc/943/stat vejfa5.elf File opened for reading /proc/41/stat vejfa5.elf File opened for reading /proc/1009/stat vejfa5.elf File opened for reading /proc/139/stat vejfa5.elf File opened for reading /proc/665/stat vejfa5.elf File opened for reading /proc/1026/stat vejfa5.elf File opened for reading /proc/23/stat vejfa5.elf File opened for reading /proc/807/stat vejfa5.elf File opened for reading /proc/18/stat vejfa5.elf File opened for reading /proc/42/stat vejfa5.elf File opened for reading /proc/667/stat vejfa5.elf File opened for reading /proc/748/stat vejfa5.elf File opened for reading /proc/806/stat vejfa5.elf File opened for reading /proc/141/stat vejfa5.elf File opened for reading /proc/277/stat vejfa5.elf File opened for reading /proc/750/stat vejfa5.elf File opened for reading /proc/899/stat vejfa5.elf File opened for reading /proc/939/stat vejfa5.elf File opened for reading /proc/970/stat vejfa5.elf File opened for reading /proc/982/stat vejfa5.elf File opened for reading /proc/2/stat vejfa5.elf File opened for reading /proc/649/stat vejfa5.elf File opened for reading /proc/852/stat vejfa5.elf File opened for reading /proc/859/stat vejfa5.elf File opened for reading /proc/959/stat vejfa5.elf File opened for reading /proc/962/stat vejfa5.elf File opened for reading /proc/21/stat vejfa5.elf File opened for reading /proc/147/stat vejfa5.elf File opened for reading /proc/409/stat vejfa5.elf File opened for reading /proc/671/stat vejfa5.elf File opened for reading /proc/986/stat vejfa5.elf File opened for reading /proc/1022/stat vejfa5.elf File opened for reading /proc/24/stat vejfa5.elf File opened for reading /proc/644/stat vejfa5.elf File opened for reading /proc/14/stat vejfa5.elf File opened for reading /proc/20/stat vejfa5.elf File opened for reading /proc/1027/stat vejfa5.elf File opened for reading /proc/104/stat vejfa5.elf File opened for reading /proc/872/stat vejfa5.elf File opened for reading /proc/5/stat vejfa5.elf File opened for reading /proc/107/stat vejfa5.elf File opened for reading /proc/808/stat vejfa5.elf File opened for reading /proc/15/stat vejfa5.elf File opened for reading /proc/28/stat vejfa5.elf File opened for reading /proc/131/stat vejfa5.elf File opened for reading /proc/738/stat vejfa5.elf File opened for reading /proc/27/stat vejfa5.elf File opened for reading /proc/9/stat vejfa5.elf File opened for reading /proc/450/stat vejfa5.elf File opened for reading /proc/922/stat vejfa5.elf File opened for reading /proc/668/stat vejfa5.elf File opened for reading /proc/917/stat vejfa5.elf File opened for reading /proc/293/stat vejfa5.elf