Analysis
-
max time kernel
146s -
max time network
125s -
platform
debian-9_mips -
resource
debian9-mipsbe-20221125-en -
resource tags
arch:mipsimage:debian9-mipsbe-20221125-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
10-08-2023 21:44
Behavioral task
behavioral1
Sample
mips
Resource
debian9-mipsbe-20221125-en
debian-9-mips
4 signatures
150 seconds
General
-
Target
mips
-
Size
194KB
-
MD5
6e1c7a1717d14aa07e3208b83c5e1bfb
-
SHA1
3fcae6ee865fbe21aec5a3e0bc3dbb6fb0780121
-
SHA256
9ccb28dbb56c1b6a631624a474e78264451226f9e44336477658b0c56bd9c7f6
-
SHA512
ef1b32dd1d51889ae60db6aa7954c9e6f9604fe131d18476983a6d6ae7b2abfdae4f84cd05c1d6523295defa6ebda763aa38548845d685873393f58c9c82bf40
-
SSDEEP
3072:x36ZrQ1yHNGjNmX6JTHPcp6sZYVR2eHJwW4BZHsh:x36FtMmX6CYZA4wWQZMh
Score
9/10
Malware Config
Signatures
-
Contacts a large (3520) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself M C 327 mips -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/1/status File opened for reading /proc/115/status File opened for reading /proc/328/status File opened for reading /proc/333/cmdline File opened for reading /proc/255/status File opened for reading /proc/330/status File opened for reading /proc/2/cmdline File opened for reading /proc/142/cmdline File opened for reading /proc/71/cmdline File opened for reading /proc/288/cmdline File opened for reading /proc/344/cmdline File opened for reading /proc/self/exe File opened for reading /proc/73/status File opened for reading /proc/12/cmdline File opened for reading /proc/37/cmdline File opened for reading /proc/351/cmdline File opened for reading /proc/406/status File opened for reading /proc/23/status File opened for reading /proc/329/status File opened for reading /proc/73/cmdline File opened for reading /proc/bus/cmdline File opened for reading /proc/332/cmdline File opened for reading /proc/tty/cmdline File opened for reading /proc/17/status File opened for reading /proc/76/status File opened for reading /proc/304/status File opened for reading /proc/332/status File opened for reading /proc/105/status File opened for reading /proc/231/status File opened for reading /proc/7/cmdline File opened for reading /proc/11/cmdline File opened for reading /proc/4/status File opened for reading /proc/9/status File opened for reading /proc/24/status File opened for reading /proc/78/status File opened for reading /proc/19/cmdline File opened for reading /proc/72/cmdline File opened for reading /proc/337/cmdline File opened for reading /proc/256/cmdline File opened for reading /proc/341/cmdline File opened for reading /proc/372/cmdline File opened for reading /proc/8/status File opened for reading /proc/323/status File opened for reading /proc/10/cmdline File opened for reading /proc/36/cmdline File opened for reading /proc/251/status File opened for reading /proc/1/cmdline File opened for reading /proc/75/cmdline File opened for reading /proc/228/cmdline File opened for reading /proc/16/cmdline File opened for reading /proc/17/cmdline File opened for reading /proc/irq/cmdline File opened for reading /proc/15/status File opened for reading /proc/72/status File opened for reading /proc/207/status File opened for reading /proc/294/cmdline File opened for reading /proc/16/status File opened for reading /proc/142/status File opened for reading /proc/277/status File opened for reading /proc/82/cmdline File opened for reading /proc/325/cmdline File opened for reading /proc/18/status File opened for reading /proc/229/status File opened for reading /proc/322/status