Analysis
- max time kernel
147s - max time network
153s - platform
debian-12_armhf - resource
debian12-armhf-20251231-en - resource tags
arch:armhfimage:debian12-armhf-20251231-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
07/01/2026, 03:53
Static task
static1
Behavioral task
behavioral1
Sample
204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf
Resource
debian12-armhf-20251231-en
debian-12-armhf
8 signatures
150 seconds
General
- Target 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf
- Size 590KB
- Sample260107-eftckaer5y
- SHA256 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff
- MD5 9ed0652e1866fdb60f35b3b48017ba39
- SHA1 838db15d7cb1e4eeee8573131beb063ffb86748e
- SHA512 6a4a149c67914d3453727f167d36c4bb5f75feea6ceeb72226cd8a341c19cd868733ca71d368d0db72843132177ab81820dca180845355f3f86e940c21d4affa
- SSDEEP 12288:OPKUCa6t/FHVTRk62N+GqFqlKNFx/Sw8g/LubqP4U8pJfScT9:Og/FHVl2IG2qlKvx/78gESI
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf - Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/sysd 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf - Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc.local 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf - Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/357/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/23/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/26/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/46/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/193/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/33/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/316/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/728/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/793/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/9/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/243/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/642/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/674/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/771/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/6/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/202/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/729/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/792/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/4/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/7/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/19/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/27/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/34/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/51/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/317/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/772/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/11/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/13/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/44/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/73/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/142/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/336/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/341/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/369/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/28/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/29/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/30/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/314/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/622/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/15/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/36/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/353/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/3/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/21/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/760/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/778/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/789/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/16/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/57/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/332/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/8/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/14/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/31/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/220/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/5/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/10/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/24/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/42/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/799/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/12/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/25/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/56/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/198/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/670/maps 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf - Changes its process name 4 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself init 781 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf Changes the process name, possibly in an attempt to hide itself dhclient 781 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf Changes the process name, possibly in an attempt to hide itself init 793 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf Changes the process name, possibly in an attempt to hide itself init 794 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf - Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/net/tcp6 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf -
description ioc Process File opened for reading /proc/778/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/17/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/29/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/36/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/220/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/353/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/6/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/57/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/674/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/794/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/46/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/12/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/243/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/357/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/1/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/5/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/44/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/332/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/20/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/16/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/26/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/787/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/797/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/10/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/25/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/45/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/789/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/73/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/642/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/15/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/34/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/15/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/760/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/31/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/357/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/13/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/19/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/316/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/369/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/781/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/23/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/28/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/670/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/641/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/4/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/193/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/2/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/4/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/11/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/729/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/193/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/51/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/143/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/733/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/33/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/33/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/220/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/674/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/14/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/34/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/44/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/772/stat 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/792/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf File opened for reading /proc/728/cmdline 204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf
Processes
-
/tmp/204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf/tmp/204fcb477d7b02455c03c83900c2ace4aa10a6422fb5eb15022a1818ca5fc5ff.elf1⤵
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:775 -
/bin/shsh -c "cp dhclient /usr/bin/.sh"2⤵PID:785
-
/usr/bin/cpcp dhclient /usr/bin/.sh3⤵PID:788
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
2RC Scripts
2Privilege Escalation
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
2RC Scripts
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/init.d/sysd
- Size 25B
- SHA256 ba1d50d125344f273c249426ccd744d5a12e560ace41cca4bc55bd2d4a718d8f
- MD5 997cb34ff6e6cded70b841c0d16c0938
- SHA1 cc85c16e2fb441d86aa668f376ca7fb4b181f1ab
- SHA512 1e775ca8513f2841b6a8e369071b28c48489ab6462d06525f9b6b2bf97e9c043562bd7e0217307ed64a95217a76a94a08189616831c9d3127c6b91b7544570c8
- MD5 SHA1 SHA512