Analysis
-
max time kernel
136s -
max time network
148s -
platform
debian-9_armhf -
resource
debian9-armhf-20250410-en -
resource tags
arch:armhfimage:debian9-armhf-20250410-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
15/04/2025, 23:02
Behavioral task
behavioral1
Sample
efefa7.elf
Resource
debian9-armhf-20250410-en
debian-9-armhf
4 signatures
150 seconds
General
-
Target
efefa7.elf
-
Size
172KB
-
MD5
32353ac6e5ca3fc430b456a8ae3f2b19
-
SHA1
5443a5bb93f979956b8133fa04f4de5dfb241ce7
-
SHA256
5b1f04f4a4aed544a64f434b28fefe201ae5942e5a12c6fa04dd9e3011123a24
-
SHA512
b91ca7955547775ff38ec8e0042875c542f13e099af09ce2c4782e520578114831bc8119579b7f7f8d211f6e7df5fe5597b540764714cc41e9f3f37aa43d302f
-
SSDEEP
3072:ya/57QWPlDtc9ayBaRm7y4p2Z77XjTIGSt8+/o+deOM/9i9DUq:b/5759xcAyBaRm7y4pw7XIjt84o+dVMa
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 647 efefa7.elf -
Reads process memory 1 TTPs 14 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/777/maps efefa7.elf File opened for reading /proc/999/maps efefa7.elf File opened for reading /proc/22/maps efefa7.elf File opened for reading /proc/44/maps efefa7.elf File opened for reading /proc/55/maps efefa7.elf File opened for reading /proc/66/maps efefa7.elf File opened for reading /proc/77/maps efefa7.elf File opened for reading /proc/99/maps efefa7.elf File opened for reading /proc/222/maps efefa7.elf File opened for reading /proc/11/maps efefa7.elf File opened for reading /proc/33/maps efefa7.elf File opened for reading /proc/88/maps efefa7.elf File opened for reading /proc/111/maps efefa7.elf File opened for reading /proc/444/maps efefa7.elf -
Changes its process name 3 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself - 646 efefa7.elf Changes the process name, possibly in an attempt to hide itself kworker/u8:0 646 efefa7.elf Changes the process name, possibly in an attempt to hide itself httpd 646 efefa7.elf -
description ioc Process File opened for reading /proc/777s�"/cmdline efefa7.elf File opened for reading /proc/33/stat efefa7.elf File opened for reading /proc/444s�"/cmdline efefa7.elf File opened for reading /proc/222�"/stat efefa7.elf File opened for reading /proc/5555�./stat efefa7.elf File opened for reading /proc/3333/maps efefa7.elf File opened for reading /proc/222l�"/cmdline efefa7.elf File opened for reading /proc/1111s3/cmdline efefa7.elf File opened for reading /proc/7777/stat efefa7.elf File opened for reading /proc/77/stat efefa7.elf File opened for reading /proc/88/stat efefa7.elf File opened for reading /proc/3333&,/cmdline efefa7.elf File opened for reading /proc/2222 +/cmdline efefa7.elf File opened for reading /proc/3333,/cmdline efefa7.elf File opened for reading /proc/111c�"/stat efefa7.elf File opened for reading /proc/222l�"/stat efefa7.elf File opened for reading /proc/444s�"/stat efefa7.elf File opened for reading /proc/999�"/stat efefa7.elf File opened for reading /proc/55/stat efefa7.elf File opened for reading /proc/6666/stat efefa7.elf File opened for reading /proc/222i�"/stat efefa7.elf File opened for reading /proc/44/stat efefa7.elf File opened for reading /proc/111�"/cmdline efefa7.elf File opened for reading /proc/222v�"/cmdline efefa7.elf File opened for reading /proc/6666}3/cmdline efefa7.elf File opened for reading /proc/1111u3/stat efefa7.elf File opened for reading /proc/444/stat efefa7.elf File opened for reading /proc/6666~3/cmdline efefa7.elf File opened for reading /proc/1111�"/stat efefa7.elf File opened for reading /proc/6666�3/stat efefa7.elf File opened for reading /proc/88ll�"/cmdline efefa7.elf File opened for reading /proc/222�"/cmdline efefa7.elf File opened for reading /proc/5555�./cmdline efefa7.elf File opened for reading /proc/2222�*/cmdline efefa7.elf File opened for reading /proc/6666�3/cmdline efefa7.elf File opened for reading /proc/777s�"/stat efefa7.elf File opened for reading /proc/2222�*/stat efefa7.elf File opened for reading /proc/1111/maps efefa7.elf File opened for reading /proc/1111�"/cmdline efefa7.elf File opened for reading /proc/88ll�"/stat efefa7.elf File opened for reading /proc/3333,/stat efefa7.elf File opened for reading /proc/6666}3/stat efefa7.elf File opened for reading /proc/6666�3/stat efefa7.elf File opened for reading /proc/1111t3/cmdline efefa7.elf File opened for reading /proc/5555/maps efefa7.elf File opened for reading /proc/222i�"/cmdline efefa7.elf File opened for reading /proc/3333,/cmdline efefa7.elf File opened for reading /proc/1111v%/stat efefa7.elf File opened for reading /proc/2222g*/stat efefa7.elf File opened for reading /proc/222/stat efefa7.elf File opened for reading /proc/111c�"/cmdline efefa7.elf File opened for reading /proc/2222w3/stat efefa7.elf File opened for reading /proc/77/cmdline efefa7.elf File opened for reading /proc/111c�"/cmdline efefa7.elf File opened for reading /proc/6666o3/stat efefa7.elf File opened for reading /proc/66/cmdline efefa7.elf File opened for reading /proc/1111�#/cmdline efefa7.elf File opened for reading /proc/2222w3/cmdline efefa7.elf File opened for reading /proc/5555V./cmdline efefa7.elf File opened for reading /proc/1111�"/stat efefa7.elf File opened for reading /proc/2222�)/stat efefa7.elf File opened for reading /proc/7777�8/stat efefa7.elf File opened for reading /proc/66/stat efefa7.elf File opened for reading /proc/5555�./cmdline efefa7.elf