Analysis
-
max time kernel
1199s -
max time network
1117s -
platform
debian-9_mips -
resource
debian9-mipsbe-20221111-en -
resource tags
arch:mipsimage:debian9-mipsbe-20221111-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
10-08-2023 21:53
Behavioral task
behavioral1
Sample
mips
Resource
debian9-mipsbe-20221111-en
debian-9-mips
4 signatures
1200 seconds
General
-
Target
mips
-
Size
194KB
-
MD5
6e1c7a1717d14aa07e3208b83c5e1bfb
-
SHA1
3fcae6ee865fbe21aec5a3e0bc3dbb6fb0780121
-
SHA256
9ccb28dbb56c1b6a631624a474e78264451226f9e44336477658b0c56bd9c7f6
-
SHA512
ef1b32dd1d51889ae60db6aa7954c9e6f9604fe131d18476983a6d6ae7b2abfdae4f84cd05c1d6523295defa6ebda763aa38548845d685873393f58c9c82bf40
-
SSDEEP
3072:x36ZrQ1yHNGjNmX6JTHPcp6sZYVR2eHJwW4BZHsh:x36FtMmX6CYZA4wWQZMh
Score
9/10
Malware Config
Signatures
-
Contacts a large (3518) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself M C 335 mips -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/165/cmdline File opened for reading /proc/507/status File opened for reading /proc/478/status File opened for reading /proc/480/status File opened for reading /proc/331/status File opened for reading /proc/13/cmdline File opened for reading /proc/145/cmdline File opened for reading /proc/9/cmdline File opened for reading /proc/75/cmdline File opened for reading /proc/349/status File opened for reading /proc/9/status File opened for reading /proc/78/status File opened for reading /proc/209/status File opened for reading /proc/15/status File opened for reading /proc/479/cmdline File opened for reading /proc/284/status File opened for reading /proc/21/cmdline File opened for reading /proc/468/cmdline File opened for reading /proc/73/cmdline File opened for reading /proc/341/cmdline File opened for reading /proc/472/status File opened for reading /proc/295/status File opened for reading /proc/376/status File opened for reading /proc/503/status File opened for reading /proc/494/status File opened for reading /proc/36/status File opened for reading /proc/379/status File opened for reading /proc/460/status File opened for reading /proc/351/status File opened for reading /proc/460/cmdline File opened for reading /proc/470/status File opened for reading /proc/498/status File opened for reading /proc/506/status File opened for reading /proc/16/status File opened for reading /proc/165/status File opened for reading /proc/cmdline File opened for reading /proc/495/status File opened for reading /proc/20/status File opened for reading /proc/21/status File opened for reading /proc/410/cmdline File opened for reading /proc/14/status File opened for reading /proc/6/cmdline File opened for reading /proc/467/status File opened for reading /proc/455/status File opened for reading /proc/70/status File opened for reading /proc/333/status File opened for reading /proc/284/cmdline File opened for reading /proc/15/cmdline File opened for reading /proc/506/cmdline File opened for reading /proc/511/status File opened for reading /proc/10/status File opened for reading /proc/82/status File opened for reading /proc/234/status File opened for reading /proc/466/status File opened for reading /proc/157/status File opened for reading /proc/339/status File opened for reading /proc/458/status File opened for reading /proc/4/status File opened for reading /proc/17/cmdline File opened for reading /proc/490/status File opened for reading /proc/2/cmdline File opened for reading /proc/461/status File opened for reading /proc/508/cmdline File opened for reading /proc/74/status