Analysis
-
max time kernel
150s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
27-12-2024 12:27
Behavioral task
behavioral1
Sample
byte.mips.elf
Resource
debian9-mipsbe-20240611-en
debian-9-mips
4 signatures
150 seconds
General
-
Target
byte.mips.elf
-
Size
104KB
-
MD5
98bcfd120f315d9a9fa3b0645db87092
-
SHA1
d151e6784d1556efb7a932a9b84effd64043bfae
-
SHA256
b3bfa58c4e2b12d2dfa7571a84ca63bd2103e2f022e0f7caa8f02607e9f96d51
-
SHA512
c63aa8a5bf7e3e3a5805732b0430747639f5424827c517ada419e1c1adcbece8b34797cb588bbcf166ddfd9bb239e7295ca88d3f3de1f35b4f5ad99bcd977523
-
SSDEEP
1536:rWSIow5K0LU/RO1L2HVjShCL8kzmEmfrhdogZeB9il61d60qH:xCfU/ROtujShCL8kzmEmfNdhGi4XqH
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog byte.mips.elf File opened for modification /dev/misc/watchdog byte.mips.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/18/cmdline byte.mips.elf File opened for reading /proc/20/cmdline byte.mips.elf File opened for reading /proc/676/cmdline byte.mips.elf File opened for reading /proc/705/cmdline byte.mips.elf File opened for reading /proc/720/cmdline byte.mips.elf File opened for reading /proc/773/cmdline byte.mips.elf File opened for reading /proc/326/cmdline byte.mips.elf File opened for reading /proc/785/cmdline byte.mips.elf File opened for reading /proc/16/cmdline byte.mips.elf File opened for reading /proc/755/cmdline byte.mips.elf File opened for reading /proc/762/cmdline byte.mips.elf File opened for reading /proc/783/cmdline byte.mips.elf File opened for reading /proc/19/cmdline byte.mips.elf File opened for reading /proc/24/cmdline byte.mips.elf File opened for reading /proc/154/cmdline byte.mips.elf File opened for reading /proc/786/cmdline byte.mips.elf File opened for reading /proc/15/cmdline byte.mips.elf File opened for reading /proc/754/cmdline byte.mips.elf File opened for reading /proc/121/cmdline byte.mips.elf File opened for reading /proc/235/cmdline byte.mips.elf File opened for reading /proc/748/cmdline byte.mips.elf File opened for reading /proc/752/cmdline byte.mips.elf File opened for reading /proc/715/cmdline byte.mips.elf File opened for reading /proc/746/cmdline byte.mips.elf File opened for reading /proc/787/cmdline byte.mips.elf File opened for reading /proc/23/cmdline byte.mips.elf File opened for reading /proc/111/cmdline byte.mips.elf File opened for reading /proc/150/cmdline byte.mips.elf File opened for reading /proc/763/cmdline byte.mips.elf File opened for reading /proc/792/cmdline byte.mips.elf File opened for reading /proc/701/cmdline byte.mips.elf File opened for reading /proc/780/cmdline byte.mips.elf File opened for reading /proc/7/cmdline byte.mips.elf File opened for reading /proc/69/cmdline byte.mips.elf File opened for reading /proc/170/cmdline byte.mips.elf File opened for reading /proc/354/cmdline byte.mips.elf File opened for reading /proc/356/cmdline byte.mips.elf File opened for reading /proc/5/cmdline byte.mips.elf File opened for reading /proc/73/cmdline byte.mips.elf File opened for reading /proc/677/cmdline byte.mips.elf File opened for reading /proc/685/cmdline byte.mips.elf File opened for reading /proc/698/cmdline byte.mips.elf File opened for reading /proc/726/cmdline byte.mips.elf File opened for reading /proc/729/cmdline byte.mips.elf File opened for reading /proc/385/cmdline byte.mips.elf File opened for reading /proc/784/cmdline byte.mips.elf File opened for reading /proc/782/cmdline byte.mips.elf File opened for reading /proc/2/cmdline byte.mips.elf File opened for reading /proc/17/cmdline byte.mips.elf File opened for reading /proc/750/cmdline byte.mips.elf File opened for reading /proc/770/cmdline byte.mips.elf File opened for reading /proc/771/cmdline byte.mips.elf File opened for reading /proc/774/cmdline byte.mips.elf File opened for reading /proc/79/cmdline byte.mips.elf File opened for reading /proc/323/cmdline byte.mips.elf File opened for reading /proc/727/cmdline byte.mips.elf File opened for reading /proc/730/cmdline byte.mips.elf File opened for reading /proc/4/cmdline byte.mips.elf File opened for reading /proc/71/cmdline byte.mips.elf File opened for reading /proc/716/cmdline byte.mips.elf File opened for reading /proc/703/cmdline byte.mips.elf File opened for reading /proc/751/cmdline byte.mips.elf File opened for reading /proc/707/cmdline byte.mips.elf File opened for reading /proc/731/cmdline byte.mips.elf -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 706 byte.mips.elf