4bf120c03a96b22d633ab5c4b1637b5f41ddf217b307327113fc779100f239de

Analysis

max time kernel
43s
max time network
79s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
10-12-2024 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hax.mips
Size

70KB
MD5

8a7160ddc5859965e6089527ddb8fd88
SHA1

d3a023dee992d4c81226337ee556f35b2b46a0ee
SHA256

4bf120c03a96b22d633ab5c4b1637b5f41ddf217b307327113fc779100f239de
SHA512

55d9721211760280a3da26c390b1e91a4e8e792d1e61442583de21aba266eef4e01781a01e612c02dd22c4590610c11a8084e115342b32ef261ee6323f0d3e84
SSDEEP

1536:mpDloH2SOP/AVDhl0dM+BYECY+uRSmSprlhYgL9ahy:mpDGHHTVP0dM+8WCprlhtZB

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (58571) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	hax.mips

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	njb1h52o0pdoke13kp	698	hax.mips

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	hax.mips

Reads runtime system information 14 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/167/fd	hax.mips
File opened for reading	/proc/328/fd	hax.mips
File opened for reading	/proc/330/fd	hax.mips
File opened for reading	/proc/376/fd	hax.mips
File opened for reading	/proc/333/fd	hax.mips
File opened for reading	/proc/335/fd	hax.mips
File opened for reading	/proc/361/fd	hax.mips
File opened for reading	/proc/1/fd	hax.mips
File opened for reading	/proc/140/fd	hax.mips
File opened for reading	/proc/375/fd	hax.mips
File opened for reading	/proc/389/fd	hax.mips
File opened for reading	/proc/700/exe	hax.mips
File opened for reading	/proc/235/fd	hax.mips
File opened for reading	/proc/402/fd	hax.mips

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
698	hax.mips

/tmp/hax.mips
/tmp/hax.mips
1⤵
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
- System Network Configuration Discovery
PID:698

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads