Analysis
-
max time kernel
151s -
max time network
153s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20231215-en -
resource tags
arch:mipselimage:debian9-mipsel-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
20-12-2023 16:49
Behavioral task
behavioral1
Sample
ed8039a626bfb139a168f31ee5326e31
Resource
debian9-mipsel-20231215-en
General
-
Target
ed8039a626bfb139a168f31ee5326e31
-
Size
95KB
-
MD5
ed8039a626bfb139a168f31ee5326e31
-
SHA1
e7b41a9cb6b1fe9cf5607f82f48000794ce09f6d
-
SHA256
8f1b850d85f7751519c1042208cc6de9b65d60f24091cbae56f19abf08996a35
-
SHA512
1a67b2acc2d8faf8e92b2e70edbe1fb3d9dabb9076dd2b0be60e13fd2e35567d3ec833b2afe8cacf86604b0e5219b745876ade5f0284e4b0ecbf102e899fd563
-
SSDEEP
1536:MZ/OLIFAxV6QHydscmOqQqRRm0Tm/1CIzK5OdA8EK4ixRn2F:MZ/FWkQqqQqYCIztz6F
Malware Config
Signatures
-
Contacts a large (195477) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Changes its process name 1 IoCs
Processes:
ed8039a626bfb139a168f31ee5326e31description ioc pid process Changes the process name, possibly in an attempt to hide itself rtsp 727 ed8039a626bfb139a168f31ee5326e31 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/net/tcp -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
description ioc File opened for reading /proc/net/tcp -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/714/exe File opened for reading /proc/893/maps File opened for reading /proc/935/exe File opened for reading /proc/960/maps File opened for reading /proc/932/maps File opened for reading /proc/994/maps File opened for reading /proc/564/maps File opened for reading /proc/746/exe File opened for reading /proc/834/maps File opened for reading /proc/872/exe File opened for reading /proc/918/exe File opened for reading /proc/947/exe File opened for reading /proc/964/maps File opened for reading /proc/783/exe File opened for reading /proc/997/maps File opened for reading /proc/984/exe File opened for reading /proc/601/maps File opened for reading /proc/779/maps File opened for reading /proc/866/exe File opened for reading /proc/875/exe File opened for reading /proc/896/exe File opened for reading /proc/977/exe File opened for reading /proc/991/maps File opened for reading /proc/728/maps File opened for reading /proc/730/maps File opened for reading /proc/810/exe File opened for reading /proc/905/maps File opened for reading /proc/921/maps File opened for reading /proc/601/exe File opened for reading /proc/830/maps File opened for reading /proc/939/maps File opened for reading /proc/950/maps File opened for reading /proc/714/maps File opened for reading /proc/717/maps File opened for reading /proc/837/maps File opened for reading /proc/886/exe File opened for reading /proc/896/maps File opened for reading /proc/550/exe File opened for reading /proc/711/exe File opened for reading /proc/875/maps File opened for reading /proc/957/maps File opened for reading /proc/712/exe File opened for reading /proc/731/maps File opened for reading /proc/810/maps File opened for reading /proc/890/exe File opened for reading /proc/912/maps File opened for reading /proc/912/exe File opened for reading /proc/935/maps File opened for reading /proc/943/maps File opened for reading /proc/954/exe File opened for reading /proc/968/maps File opened for reading /proc/734/maps File opened for reading /proc/859/exe File opened for reading /proc/779/exe File opened for reading /proc/834/exe File opened for reading /proc/847/maps File opened for reading /proc/908/exe File opened for reading /proc/968/exe File opened for reading /proc/411/exe File opened for reading /proc/550/maps File opened for reading /proc/847/exe File opened for reading /proc/600/maps File opened for reading /proc/712/maps File opened for reading /proc/928/maps