Analysis
-
max time kernel
150s -
max time network
152s -
platform
debian-9_mips -
resource
debian9-mipsbe-20221125-en -
resource tags
arch:mipsimage:debian9-mipsbe-20221125-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
18-07-2023 16:51
Behavioral task
behavioral1
Sample
mips
Resource
debian9-mipsbe-20221125-en
debian-9-mips
5 signatures
150 seconds
General
-
Target
mips
-
Size
186KB
-
MD5
4bbc57bcb95f8f4109a92932d052d270
-
SHA1
bb5ee2008bb61c142f940c646ca482d8aa2c8646
-
SHA256
befca934b080e6c0ad958e2590cb540389525ca94189bdaab6aa75dbb0491de1
-
SHA512
19857321d219512ecfc6ef5098e0d0444fe2185d6abc5256ea72f444e5afc0f4a77b7f6c3a3e052733a8938fe6b72f2fc53f41335dbd59a9361be347904ef203
-
SSDEEP
3072:prDNZXSACW9ftsF/+y1ib9k4Obrx17ZpbyHRtaSab2jHpmC:prDvCDZ1ib9k4U7zGHR1ab2jJmC
Score
9/10
Malware Config
Signatures
-
Contacts a large (93923) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
Processes:
mipsdescription ioc pid Process Changes the process name, possibly in an attempt to hide itself M C 325 mips -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/68/status File opened for reading /proc/37/cmdline File opened for reading /proc/tty/cmdline File opened for reading /proc/221/status File opened for reading /proc/287/status File opened for reading /proc/75/cmdline File opened for reading /proc/296/cmdline File opened for reading /proc/235/status File opened for reading /proc/15/cmdline File opened for reading /proc/83/cmdline File opened for reading /proc/74/status File opened for reading /proc/217/cmdline File opened for reading /proc/287/cmdline File opened for reading /proc/332/cmdline File opened for reading /proc/340/status File opened for reading /proc/14/status File opened for reading /proc/329/status File opened for reading /proc/330/status File opened for reading /proc/1/cmdline File opened for reading /proc/22/cmdline File opened for reading /proc/24/cmdline File opened for reading /proc/70/cmdline File opened for reading /proc/2/status File opened for reading /proc/36/status File opened for reading /proc/139/status File opened for reading /proc/296/status File opened for reading /proc/6/cmdline File opened for reading /proc/7/cmdline File opened for reading /proc/11/cmdline File opened for reading /proc/12/cmdline File opened for reading /proc/207/cmdline File opened for reading /proc/cmdline File opened for reading /proc/driver/cmdline File opened for reading /proc/346/cmdline File opened for reading /proc/71/cmdline File opened for reading /proc/218/cmdline File opened for reading /proc/221/cmdline File opened for reading /proc/276/cmdline File opened for reading /proc/371/status File opened for reading /proc/79/status File opened for reading /proc/324/status File opened for reading /proc/3/cmdline File opened for reading /proc/336/status File opened for reading /proc/397/cmdline File opened for reading /proc/7/status File opened for reading /proc/217/status File opened for reading /proc/21/cmdline File opened for reading /proc/254/cmdline File opened for reading /proc/323/cmdline File opened for reading /proc/327/cmdline File opened for reading /proc/5/cmdline File opened for reading /proc/295/cmdline File opened for reading /proc/371/cmdline File opened for reading /proc/8/status File opened for reading /proc/20/status File opened for reading /proc/23/status File opened for reading /proc/83/status File opened for reading /proc/218/status File opened for reading /proc/160/cmdline File opened for reading /proc/329/cmdline File opened for reading /proc/331/cmdline File opened for reading /proc/336/cmdline File opened for reading /proc/11/status File opened for reading /proc/sysvipc/cmdline