Analysis
-
max time kernel
150s -
max time network
155s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
13-12-2024 09:26
Behavioral task
behavioral1
Sample
byte.mips.elf
Resource
debian9-mipsbe-20240611-en
debian-9-mips
4 signatures
150 seconds
General
-
Target
byte.mips.elf
-
Size
117KB
-
MD5
21cb220963a78fb1248b54aaa8436ad9
-
SHA1
2b6939f4f160f730894eb46cd30c6dfd43cc5c73
-
SHA256
eb52b30de09a45e5f476f759b879c4bf76d83408f98051862f32a49924e65a2a
-
SHA512
47f9c131aea5eff3803052dbb7c4218b914e0997304c1fc9ab29c3ccad7c1f2e0de175aab6482dfdf23d27733eec7e8563070368656389dddf9fbbe3d0eacc67
-
SSDEEP
1536:c7e+RDMIb5flkDQSbl5jRA/IajbkRSN2ofdC4V/Ie7pVpXBCl61d6/FN:J+aIb5fyj5ajbkRSN2ofxV/5BC4IFN
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog byte.mips.elf File opened for modification /dev/misc/watchdog byte.mips.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/751/exe byte.mips.elf File opened for reading /proc/815/cmdline byte.mips.elf File opened for reading /proc/18/cmdline byte.mips.elf File opened for reading /proc/376/cmdline byte.mips.elf File opened for reading /proc/456/cmdline byte.mips.elf File opened for reading /proc/732/net/tcp byte.mips.elf File opened for reading /proc/734/net/tcp byte.mips.elf File opened for reading /proc/361/net/tcp byte.mips.elf File opened for reading /proc/706/net/tcp byte.mips.elf File opened for reading /proc/803/net/tcp byte.mips.elf File opened for reading /proc/167/net/tcp byte.mips.elf File opened for reading /proc/754/cmdline byte.mips.elf File opened for reading /proc/773/net/tcp byte.mips.elf File opened for reading /proc/774/cmdline byte.mips.elf File opened for reading /proc/804/net/tcp byte.mips.elf File opened for reading /proc/723/net/tcp byte.mips.elf File opened for reading /proc/738/net/tcp byte.mips.elf File opened for reading /proc/758/cmdline byte.mips.elf File opened for reading /proc/697/exe byte.mips.elf File opened for reading /proc/794/cmdline byte.mips.elf File opened for reading /proc/703/exe byte.mips.elf File opened for reading /proc/764/net/tcp byte.mips.elf File opened for reading /proc/768/cmdline byte.mips.elf File opened for reading /proc/713/net/tcp byte.mips.elf File opened for reading /proc/10/cmdline byte.mips.elf File opened for reading /proc/116/cmdline byte.mips.elf File opened for reading /proc/402/cmdline byte.mips.elf File opened for reading /proc/733/cmdline byte.mips.elf File opened for reading /proc/492/cmdline byte.mips.elf File opened for reading /proc/825/net/tcp byte.mips.elf File opened for reading /proc/752/exe byte.mips.elf File opened for reading /proc/492/net/tcp byte.mips.elf File opened for reading /proc/14/cmdline byte.mips.elf File opened for reading /proc/24/cmdline byte.mips.elf File opened for reading /proc/774/net/tcp byte.mips.elf File opened for reading /proc/692/net/tcp byte.mips.elf File opened for reading /proc/724/net/tcp byte.mips.elf File opened for reading /proc/730/net/tcp byte.mips.elf File opened for reading /proc/809/cmdline byte.mips.elf File opened for reading /proc/813/net/tcp byte.mips.elf File opened for reading /proc/691/net/tcp byte.mips.elf File opened for reading /proc/694/cmdline byte.mips.elf File opened for reading /proc/745/net/tcp byte.mips.elf File opened for reading /proc/819/cmdline byte.mips.elf File opened for reading /proc/747/cmdline byte.mips.elf File opened for reading /proc/5/cmdline byte.mips.elf File opened for reading /proc/17/cmdline byte.mips.elf File opened for reading /proc/697/cmdline byte.mips.elf File opened for reading /proc/751/cmdline byte.mips.elf File opened for reading /proc/797/net/tcp byte.mips.elf File opened for reading /proc/779/cmdline byte.mips.elf File opened for reading /proc/2/cmdline byte.mips.elf File opened for reading /proc/731/net/tcp byte.mips.elf File opened for reading /proc/742/net/tcp byte.mips.elf File opened for reading /proc/749/cmdline byte.mips.elf File opened for reading /proc/777/cmdline byte.mips.elf File opened for reading /proc/330/net/tcp byte.mips.elf File opened for reading /proc/716/net/tcp byte.mips.elf File opened for reading /proc/805/cmdline byte.mips.elf File opened for reading /proc/83/cmdline byte.mips.elf File opened for reading /proc/726/cmdline byte.mips.elf File opened for reading /proc/767/net/tcp byte.mips.elf File opened for reading /proc/787/net/tcp byte.mips.elf File opened for reading /proc/806/cmdline byte.mips.elf -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 699 byte.mips.elf