Analysis
- max time kernel
146s - max time network
152s - platform
debian-9_armhf - resource
debian9-armhf-20240611-en - resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
20/03/2025, 16:46
Behavioral task
behavioral1
Sample
efefa7.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
- Target efefa7.elf
- Size 170KB
- Sample250320-t91fasvzhy
- SHA256 72f05aa42e6c79b08afa761caf810df3bf7e8bedfae8fdf5e8d212bf06c84355
- MD5 9a26f193f98eb089d54523af3f668827
- SHA1 dfddca69ff82e64a9c87cf96a6eb5aa5434358a8
- SHA512 2bdee6011be3b76c50c365be3e596abc229aae797f6bf4ce6d1c65651df9c7389cbe4e9f92774d2385380463aaea7ecfcd8f99fb9134a46362aca3b9e8b929f0
- SSDEEP 3072:x8azJ7uI538zzMS1aaupd1+FK374PINUYA3yix8oM/9Ewdfcx:x8azJ7t8fd1aaupd1+g3SIOYyyix5M/2
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 653 efefa7.elf - Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself - 651 efefa7.elf Changes the process name, possibly in an attempt to hide itself httpd 651 efefa7.elf -
description ioc Process File opened for reading /proc/99/cmdline efefa7.elf File opened for reading /proc/222i�"/stat efefa7.elf File opened for reading /proc/6666�3/stat efefa7.elf File opened for reading /proc/2222?*/cmdline efefa7.elf File opened for reading /proc/2222�*/cmdline efefa7.elf File opened for reading /proc/88ll�"/stat efefa7.elf File opened for reading /proc/3333,/stat efefa7.elf File opened for reading /proc/3333�3/cmdline efefa7.elf File opened for reading /proc/99/stat efefa7.elf File opened for reading /proc/111�"/stat efefa7.elf File opened for reading /proc/777s�"/stat efefa7.elf File opened for reading /proc/3333/stat efefa7.elf File opened for reading /proc/6666�3/stat efefa7.elf File opened for reading /proc/6666�3/stat efefa7.elf File opened for reading /proc/111�"/cmdline efefa7.elf File opened for reading /proc/2222+/cmdline efefa7.elf File opened for reading /proc/5555P/cmdline efefa7.elf File opened for reading /proc/2222?*/stat efefa7.elf File opened for reading /proc/2222R,/stat efefa7.elf File opened for reading /proc/66663/stat efefa7.elf File opened for reading /proc/2222t*/stat efefa7.elf File opened for reading /proc/66662/stat efefa7.elf File opened for reading /proc/11110%/cmdline efefa7.elf File opened for reading /proc/55/stat efefa7.elf File opened for reading /proc/111/stat efefa7.elf File opened for reading /proc/111�"/stat efefa7.elf File opened for reading /proc/222/stat efefa7.elf File opened for reading /proc/55/cmdline efefa7.elf File opened for reading /proc/111m�"/stat efefa7.elf File opened for reading /proc/999�"/stat efefa7.elf File opened for reading /proc/1111�"/stat efefa7.elf File opened for reading /proc/66662/cmdline efefa7.elf File opened for reading /proc/444s�"/cmdline efefa7.elf File opened for reading /proc/6666�3/cmdline efefa7.elf File opened for reading /proc/5555�/stat efefa7.elf File opened for reading /proc/66666/stat efefa7.elf File opened for reading /proc/77/cmdline efefa7.elf File opened for reading /proc/111/cmdline efefa7.elf File opened for reading /proc/6666�3/cmdline efefa7.elf File opened for reading /proc/44/stat efefa7.elf File opened for reading /proc/444s�"/stat efefa7.elf File opened for reading /proc/2222�3/stat efefa7.elf File opened for reading /proc/6666�3/stat efefa7.elf File opened for reading /proc/33/cmdline efefa7.elf File opened for reading /proc/1111�(/cmdline efefa7.elf File opened for reading /proc/3333/cmdline efefa7.elf File opened for reading /proc/6666�3/cmdline efefa7.elf File opened for reading /proc/6666�3/cmdline efefa7.elf File opened for reading /proc/222s�"/stat efefa7.elf File opened for reading /proc/222�"/stat efefa7.elf File opened for reading /proc/5555�/stat efefa7.elf File opened for reading /proc/111m�"/cmdline efefa7.elf File opened for reading /proc/1111+$/cmdline efefa7.elf File opened for reading /proc/3333V,/cmdline efefa7.elf File opened for reading /proc/11110%/stat efefa7.elf File opened for reading /proc/88ll�"/cmdline efefa7.elf File opened for reading /proc/222/cmdline efefa7.elf File opened for reading /proc/222s�"/cmdline efefa7.elf File opened for reading /proc/222�"/cmdline efefa7.elf File opened for reading /proc/777s�"/cmdline efefa7.elf File opened for reading /proc/6666�3/cmdline efefa7.elf File opened for reading /proc/1111�(/stat efefa7.elf File opened for reading /proc/11/stat efefa7.elf File opened for reading /proc/3333,/cmdline efefa7.elf