Analysis
-
max time kernel
150s -
max time network
150s -
platform
debian-9_mips -
resource
debian9-mipsbe-20221111-en -
resource tags
arch:mipsimage:debian9-mipsbe-20221111-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
22-08-2023 16:12
Static task
static1
Behavioral task
behavioral1
Sample
concakhbtandhuy.mips.elf
Resource
debian9-mipsbe-20221111-en
debian-9-mips
3 signatures
150 seconds
General
-
Target
concakhbtandhuy.mips.elf
-
Size
162KB
-
MD5
f7b6cc980b64c28b9713ca7835d38dc2
-
SHA1
d7dbd3c8329ad4894cfd78ed9dcad17a9ed7af8a
-
SHA256
5c62fc4e418dea0d0c3dbeda1ce422c15c0041cf5cfc9910a7ef73062efd600e
-
SHA512
39f399ea59f68edf4e83e948d8253a0515f036abfc672a54d7508e7c68e05a6b3f888e48ed4d24a369f4e1d69bf5af5c3ebf4203fcf6424768f890a63b0e5019
-
SSDEEP
1536:j/cOqkAIE2Yci917WDNGuS0IMoO1B7qroerzqsWWCLTNiUQfmh78NBLioV:j/vBchWD4utI9O1dqrrzqlglfm8NBLim
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 327 concakhbtandhuy.mips.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/115/cmdline File opened for reading /proc/158/cmdline File opened for reading /proc/228/cmdline File opened for reading /proc/326/cmdline File opened for reading /proc/7/cmdline File opened for reading /proc/11/cmdline File opened for reading /proc/23/cmdline File opened for reading /proc/73/cmdline File opened for reading /proc/22/cmdline File opened for reading /proc/330/cmdline File opened for reading /proc/333/cmdline File opened for reading /proc/81/cmdline File opened for reading /proc/207/cmdline File opened for reading /proc/229/cmdline File opened for reading /proc/322/cmdline File opened for reading /proc/147/cmdline File opened for reading /proc/301/cmdline File opened for reading /proc/5/cmdline File opened for reading /proc/8/cmdline File opened for reading /proc/17/cmdline File opened for reading /proc/116/cmdline File opened for reading /proc/255/cmdline File opened for reading /proc/6/cmdline File opened for reading /proc/13/cmdline File opened for reading /proc/76/cmdline File opened for reading /proc/105/cmdline File opened for reading /proc/284/cmdline File opened for reading /proc/328/cmdline File opened for reading /proc/14/cmdline File opened for reading /proc/18/cmdline File opened for reading /proc/77/cmdline File opened for reading /proc/231/cmdline File opened for reading /proc/10/cmdline File opened for reading /proc/36/cmdline File opened for reading /proc/300/cmdline File opened for reading /proc/230/cmdline File opened for reading /proc/323/cmdline File opened for reading /proc/15/cmdline File opened for reading /proc/37/cmdline File opened for reading /proc/74/cmdline File opened for reading /proc/217/cmdline File opened for reading /proc/1/cmdline File opened for reading /proc/3/cmdline File opened for reading /proc/82/cmdline File opened for reading /proc/289/cmdline File opened for reading /proc/9/cmdline File opened for reading /proc/16/cmdline File opened for reading /proc/71/cmdline File opened for reading /proc/325/cmdline File opened for reading /proc/12/cmdline File opened for reading /proc/21/cmdline File opened for reading /proc/24/cmdline File opened for reading /proc/72/cmdline File opened for reading /proc/280/cmdline File opened for reading /proc/69/cmdline File opened for reading /proc/142/cmdline File opened for reading /proc/251/cmdline File opened for reading /proc/252/cmdline File opened for reading /proc/70/cmdline File opened for reading /proc/329/cmdline File opened for reading /proc/2/cmdline File opened for reading /proc/4/cmdline File opened for reading /proc/19/cmdline File opened for reading /proc/20/cmdline