Analysis
-
max time kernel
150s -
max time network
152s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
13-12-2024 09:19
Behavioral task
behavioral1
Sample
byte.mips.elf
Resource
debian9-mipsbe-20240611-en
debian-9-mips
4 signatures
150 seconds
General
-
Target
byte.mips.elf
-
Size
117KB
-
MD5
21cb220963a78fb1248b54aaa8436ad9
-
SHA1
2b6939f4f160f730894eb46cd30c6dfd43cc5c73
-
SHA256
eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a
-
SHA512
47f9c131aea5eff3803052dbb7c4218b914e0997304c1fc9ab29c3ccad7c1f2e0de175aab6482dfdf23d27733eec7e8563070368656389dddf9fbbe3d0eacc67
-
SSDEEP
1536:c7e+RDMIb5flkDQSbl5jRA/IajbkRSN2ofdC4V/Ie7pVpXBCl61d6/FN:J+aIb5fyj5ajbkRSN2ofxV/5BC4IFN
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog byte.mips.elf File opened for modification /dev/misc/watchdog byte.mips.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/764/cmdline byte.mips.elf File opened for reading /proc/790/net/tcp byte.mips.elf File opened for reading /proc/820/cmdline byte.mips.elf File opened for reading /proc/746/net/tcp byte.mips.elf File opened for reading /proc/803/net/tcp byte.mips.elf File opened for reading /proc/741/cmdline byte.mips.elf File opened for reading /proc/813/cmdline byte.mips.elf File opened for reading /proc/312/net/tcp byte.mips.elf File opened for reading /proc/19/cmdline byte.mips.elf File opened for reading /proc/816/exe byte.mips.elf File opened for reading /proc/711/net/tcp byte.mips.elf File opened for reading /proc/759/net/tcp byte.mips.elf File opened for reading /proc/761/net/tcp byte.mips.elf File opened for reading /proc/779/net/tcp byte.mips.elf File opened for reading /proc/740/net/tcp byte.mips.elf File opened for reading /proc/779/cmdline byte.mips.elf File opened for reading /proc/788/net/tcp byte.mips.elf File opened for reading /proc/773/net/tcp byte.mips.elf File opened for reading /proc/724/cmdline byte.mips.elf File opened for reading /proc/777/net/tcp byte.mips.elf File opened for reading /proc/696/exe byte.mips.elf File opened for reading /proc/115/cmdline byte.mips.elf File opened for reading /proc/762/net/tcp byte.mips.elf File opened for reading /proc/784/cmdline byte.mips.elf File opened for reading /proc/147/net/tcp byte.mips.elf File opened for reading /proc/749/cmdline byte.mips.elf File opened for reading /proc/770/net/tcp byte.mips.elf File opened for reading /proc/812/cmdline byte.mips.elf File opened for reading /proc/663/cmdline byte.mips.elf File opened for reading /proc/786/net/tcp byte.mips.elf File opened for reading /proc/801/cmdline byte.mips.elf File opened for reading /proc/669/cmdline byte.mips.elf File opened for reading /proc/72/cmdline byte.mips.elf File opened for reading /proc/700/cmdline byte.mips.elf File opened for reading /proc/741/net/tcp byte.mips.elf File opened for reading /proc/764/net/tcp byte.mips.elf File opened for reading /proc/775/net/tcp byte.mips.elf File opened for reading /proc/802/cmdline byte.mips.elf File opened for reading /proc/334/net/tcp byte.mips.elf File opened for reading /proc/754/net/tcp byte.mips.elf File opened for reading /proc/307/net/tcp byte.mips.elf File opened for reading /proc/742/net/tcp byte.mips.elf File opened for reading /proc/748/net/tcp byte.mips.elf File opened for reading /proc/757/net/tcp byte.mips.elf File opened for reading /proc/21/cmdline byte.mips.elf File opened for reading /proc/702/cmdline byte.mips.elf File opened for reading /proc/740/cmdline byte.mips.elf File opened for reading /proc/784/net/tcp byte.mips.elf File opened for reading /proc/808/cmdline byte.mips.elf File opened for reading /proc/810/net/tcp byte.mips.elf File opened for reading /proc/819/net/tcp byte.mips.elf File opened for reading /proc/697/cmdline byte.mips.elf File opened for reading /proc/735/net/tcp byte.mips.elf File opened for reading /proc/744/net/tcp byte.mips.elf File opened for reading /proc/774/net/tcp byte.mips.elf File opened for reading /proc/782/net/tcp byte.mips.elf File opened for reading /proc/783/cmdline byte.mips.elf File opened for reading /proc/821/cmdline byte.mips.elf File opened for reading /proc/69/cmdline byte.mips.elf File opened for reading /proc/776/cmdline byte.mips.elf File opened for reading /proc/742/cmdline byte.mips.elf File opened for reading /proc/781/cmdline byte.mips.elf File opened for reading /proc/806/cmdline byte.mips.elf File opened for reading /proc/23/cmdline byte.mips.elf -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 699 byte.mips.elf