Analysis
-
max time kernel
140s -
max time network
149s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20231221-en -
resource tags
arch:mipselimage:debian9-mipsel-20231221-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
21-02-2024 03:45
Static task
static1
Behavioral task
behavioral1
Sample
9018b477d00eab9d62a8bf875951d3dd470add722996db0ebdf6e93bb90b15af.elf
Resource
debian9-mipsel-20231221-en
debian-9-mipsel
3 signatures
150 seconds
General
-
Target
9018b477d00eab9d62a8bf875951d3dd470add722996db0ebdf6e93bb90b15af.elf
-
Size
116KB
-
MD5
2f5d6a5406f6d0949dc9cb93c96feb20
-
SHA1
e86882909730f5e4427cc771cadd81d4b0ca7d14
-
SHA256
9018b477d00eab9d62a8bf875951d3dd470add722996db0ebdf6e93bb90b15af
-
SHA512
31b815a74a0fa4921882ddbca5879cde16d8e75e5fbfa3b2e11a67ff03c6a48209b3ced6f872ef9723314d6ed4a338a6eea41ca65273371aeb148867109f50b9
-
SSDEEP
1536:umSoeTABpDae/NfeKOpyzLZ3UX1y6wo7I/XbXj+vg8:uMvfeKOp4LrKqXbT8
Score
7/10
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/sbin/dropbear 718 9018b477d00eab9d62a8bf875951d3dd470add722996db0ebdf6e93bb90b15af.elf -
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route 9018b477d00eab9d62a8bf875951d3dd470add722996db0ebdf6e93bb90b15af.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route 9018b477d00eab9d62a8bf875951d3dd470add722996db0ebdf6e93bb90b15af.elf