Analysis
- max time kernel
72s - max time network
150s - platform
debian-9_mipsel - resource
debian9-mipsel-20240611-en - resource tags
arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem - submitted
26/03/2025, 22:18
Behavioral task
behavioral1
Sample
rrrdsl.elf
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
5 signatures
150 seconds
General
- Target rrrdsl.elf
- Size 205KB
- Sample250326-1713datyay
- SHA256 2ad3fef075eb7eb5f5c91e47c160fb83f2d83128ffc4aab944c42bb3c122fbba
- MD5 b6bdf85d33db1b1190950a3de090494b
- SHA1 34e146e4d35bac9aa9bae83020ce7a726ef347ab
- SHA512 0cbe8382a73a13a20cd335aea4a736418f790a3f234963950e16d24ba90bfc12483223deeabcb69f8a966b256c53f46480409e87bff2e60705758e2084347864
- SSDEEP 3072:6pxl2xancOOWmCAhDMhf+o9qsfPcqAoPcOxAIht:6pxl0anLOW5WK+o5flpPcgB
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 710 rrrdsl.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/676/maps rrrdsl.elf File opened for reading /proc/681/maps rrrdsl.elf File opened for reading /proc/5/maps rrrdsl.elf File opened for reading /proc/15/maps rrrdsl.elf File opened for reading /proc/37/maps rrrdsl.elf File opened for reading /proc/82/maps rrrdsl.elf File opened for reading /proc/791/maps rrrdsl.elf File opened for reading /proc/813/maps rrrdsl.elf File opened for reading /proc/822/maps rrrdsl.elf File opened for reading /proc/886/maps rrrdsl.elf File opened for reading /proc/3/maps rrrdsl.elf File opened for reading /proc/20/maps rrrdsl.elf File opened for reading /proc/76/maps rrrdsl.elf File opened for reading /proc/706/maps rrrdsl.elf File opened for reading /proc/806/maps rrrdsl.elf File opened for reading /proc/853/maps rrrdsl.elf File opened for reading /proc/897/maps rrrdsl.elf File opened for reading /proc/10/maps rrrdsl.elf File opened for reading /proc/22/maps rrrdsl.elf File opened for reading /proc/23/maps rrrdsl.elf File opened for reading /proc/384/maps rrrdsl.elf File opened for reading /proc/674/maps rrrdsl.elf File opened for reading /proc/889/maps rrrdsl.elf File opened for reading /proc/890/maps rrrdsl.elf File opened for reading /proc/16/maps rrrdsl.elf File opened for reading /proc/73/maps rrrdsl.elf File opened for reading /proc/713/maps rrrdsl.elf File opened for reading /proc/896/maps rrrdsl.elf File opened for reading /proc/703/maps rrrdsl.elf File opened for reading /proc/799/maps rrrdsl.elf File opened for reading /proc/820/maps rrrdsl.elf File opened for reading /proc/855/maps rrrdsl.elf File opened for reading /proc/882/maps rrrdsl.elf File opened for reading /proc/24/maps rrrdsl.elf File opened for reading /proc/36/maps rrrdsl.elf File opened for reading /proc/70/maps rrrdsl.elf File opened for reading /proc/14/maps rrrdsl.elf File opened for reading /proc/9/maps rrrdsl.elf File opened for reading /proc/74/maps rrrdsl.elf File opened for reading /proc/823/maps rrrdsl.elf File opened for reading /proc/71/maps rrrdsl.elf File opened for reading /proc/84/maps rrrdsl.elf File opened for reading /proc/888/maps rrrdsl.elf File opened for reading /proc/122/maps rrrdsl.elf File opened for reading /proc/157/maps rrrdsl.elf File opened for reading /proc/353/maps rrrdsl.elf File opened for reading /proc/854/maps rrrdsl.elf File opened for reading /proc/19/maps rrrdsl.elf File opened for reading /proc/149/maps rrrdsl.elf File opened for reading /proc/238/maps rrrdsl.elf File opened for reading /proc/809/maps rrrdsl.elf File opened for reading /proc/2/maps rrrdsl.elf File opened for reading /proc/12/maps rrrdsl.elf File opened for reading /proc/17/maps rrrdsl.elf File opened for reading /proc/349/maps rrrdsl.elf File opened for reading /proc/440/maps rrrdsl.elf File opened for reading /proc/670/maps rrrdsl.elf File opened for reading /proc/705/maps rrrdsl.elf File opened for reading /proc/712/maps rrrdsl.elf File opened for reading /proc/13/maps rrrdsl.elf File opened for reading /proc/78/maps rrrdsl.elf File opened for reading /proc/174/maps rrrdsl.elf File opened for reading /proc/350/maps rrrdsl.elf File opened for reading /proc/378/maps rrrdsl.elf - Changes its process name 3 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself - 708 rrrdsl.elf Changes the process name, possibly in an attempt to hide itself kworker/u8:0 708 rrrdsl.elf Changes the process name, possibly in an attempt to hide itself httpd 708 rrrdsl.elf -
description ioc Process File opened for reading /proc/174/fd rrrdsl.elf File opened for reading /proc/78/stat rrrdsl.elf File opened for reading /proc/350cmdline rrrdsl.elf File opened for reading /proc/14cmdline rrrdsl.elf File opened for reading /proc/149cmdline rrrdsl.elf File opened for reading /proc/157cmdline rrrdsl.elf File opened for reading /proc/70/cmdline rrrdsl.elf File opened for reading /proc/76/cmdline rrrdsl.elf File opened for reading /proc/23/stat rrrdsl.elf File opened for reading /proc/327/stat rrrdsl.elf File opened for reading /proc/174/cmdline rrrdsl.elf File opened for reading /proc/379/cmdline rrrdsl.elf File opened for reading /proc/807/fd rrrdsl.elf File opened for reading /proc/859/stat rrrdsl.elf File opened for reading /proc/886/stat rrrdsl.elf File opened for reading /proc/892/cmdline rrrdsl.elf File opened for reading /proc/440cmdline rrrdsl.elf File opened for reading /proc/846/fd rrrdsl.elf File opened for reading /proc/887/cmdline rrrdsl.elf File opened for reading /proc/7/stat rrrdsl.elf File opened for reading /proc/17/stat rrrdsl.elf File opened for reading /proc/706/stat rrrdsl.elf File opened for reading /proc/700/cmdline rrrdsl.elf File opened for reading /proc/836/cmdline rrrdsl.elf File opened for reading /proc/12/stat rrrdsl.elf File opened for reading /proc/847/fd rrrdsl.elf File opened for reading /proc/22/stat rrrdsl.elf File opened for reading /proc/11/stat rrrdsl.elf File opened for reading /proc/36/stat rrrdsl.elf File opened for reading /proc/174/stat rrrdsl.elf File opened for reading /proc/18cmdline rrrdsl.elf File opened for reading /proc/81cmdline rrrdsl.elf File opened for reading /proc/703cmdline rrrdsl.elf File opened for reading /proc/20/stat rrrdsl.elf File opened for reading /proc/75/stat rrrdsl.elf File opened for reading /proc/353/cmdline rrrdsl.elf File opened for reading /proc/823/fd rrrdsl.elf File opened for reading /proc/871/fd rrrdsl.elf File opened for reading /proc/384cmdline rrrdsl.elf File opened for reading /proc/37cmdline rrrdsl.elf File opened for reading /proc/806/cmdline rrrdsl.elf File opened for reading /proc/890/stat rrrdsl.elf File opened for reading /proc/896/fd rrrdsl.elf File opened for reading /proc/899/fd rrrdsl.elf File opened for reading /proc/896/cmdline rrrdsl.elf File opened for reading /proc/23cmdline rrrdsl.elf File opened for reading /proc/327cmdline rrrdsl.elf File opened for reading /proc/701/stat rrrdsl.elf File opened for reading /proc/4/cmdline rrrdsl.elf File opened for reading /proc/440/cmdline rrrdsl.elf File opened for reading /proc/707/cmdline rrrdsl.elf File opened for reading /proc/349/stat rrrdsl.elf File opened for reading /proc/74/cmdline rrrdsl.elf File opened for reading /proc/149/fd rrrdsl.elf File opened for reading /proc/829/fd rrrdsl.elf File opened for reading /proc/891/cmdline rrrdsl.elf File opened for reading /proc/674/stat rrrdsl.elf File opened for reading /proc/19/cmdline rrrdsl.elf File opened for reading /proc/714/fd rrrdsl.elf File opened for reading /proc/844/fd rrrdsl.elf File opened for reading /proc/860/stat rrrdsl.elf File opened for reading /proc/78/cmdline rrrdsl.elf File opened for reading /proc/906/stat rrrdsl.elf File opened for reading /proc/8/cmdline rrrdsl.elf