Analysis
-
max time kernel
150s -
max time network
154s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
27-12-2024 12:38
Behavioral task
behavioral1
Sample
byte.mips.elf
Resource
debian9-mipsbe-20240611-en
debian-9-mips
4 signatures
150 seconds
General
-
Target
byte.mips.elf
-
Size
104KB
-
MD5
98bcfd120f315d9a9fa3b0645db87092
-
SHA1
d151e6784d1556efb7a932a9b84effd64043bfae
-
SHA256
b3bfa58c4e2b12d2dfa7571a84ca63bd2103e2f022e0f7caa8f02607e9f96d51
-
SHA512
c63aa8a5bf7e3e3a5805732b0430747639f5424827c517ada419e1c1adcbece8b34797cb588bbcf166ddfd9bb239e7295ca88d3f3de1f35b4f5ad99bcd977523
-
SSDEEP
1536:rWSIow5K0LU/RO1L2HVjShCL8kzmEmfrhdogZeB9il61d60qH:xCfU/ROtujShCL8kzmEmfNdhGi4XqH
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog byte.mips.elf File opened for modification /dev/misc/watchdog byte.mips.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/147/cmdline byte.mips.elf File opened for reading /proc/725/cmdline byte.mips.elf File opened for reading /proc/67/cmdline byte.mips.elf File opened for reading /proc/81/cmdline byte.mips.elf File opened for reading /proc/11/cmdline byte.mips.elf File opened for reading /proc/104/cmdline byte.mips.elf File opened for reading /proc/719/cmdline byte.mips.elf File opened for reading /proc/37/cmdline byte.mips.elf File opened for reading /proc/487/cmdline byte.mips.elf File opened for reading /proc/758/cmdline byte.mips.elf File opened for reading /proc/782/cmdline byte.mips.elf File opened for reading /proc/321/cmdline byte.mips.elf File opened for reading /proc/721/cmdline byte.mips.elf File opened for reading /proc/730/cmdline byte.mips.elf File opened for reading /proc/14/cmdline byte.mips.elf File opened for reading /proc/709/cmdline byte.mips.elf File opened for reading /proc/452/cmdline byte.mips.elf File opened for reading /proc/690/cmdline byte.mips.elf File opened for reading /proc/742/cmdline byte.mips.elf File opened for reading /proc/745/cmdline byte.mips.elf File opened for reading /proc/771/cmdline byte.mips.elf File opened for reading /proc/3/cmdline byte.mips.elf File opened for reading /proc/372/cmdline byte.mips.elf File opened for reading /proc/18/cmdline byte.mips.elf File opened for reading /proc/113/cmdline byte.mips.elf File opened for reading /proc/373/cmdline byte.mips.elf File opened for reading /proc/385/cmdline byte.mips.elf File opened for reading /proc/675/cmdline byte.mips.elf File opened for reading /proc/772/cmdline byte.mips.elf File opened for reading /proc/1/cmdline byte.mips.elf File opened for reading /proc/9/cmdline byte.mips.elf File opened for reading /proc/72/cmdline byte.mips.elf File opened for reading /proc/74/cmdline byte.mips.elf File opened for reading /proc/696/cmdline byte.mips.elf File opened for reading /proc/708/cmdline byte.mips.elf File opened for reading /proc/723/cmdline byte.mips.elf File opened for reading /proc/755/cmdline byte.mips.elf File opened for reading /proc/763/cmdline byte.mips.elf File opened for reading /proc/36/cmdline byte.mips.elf File opened for reading /proc/695/cmdline byte.mips.elf File opened for reading /proc/775/cmdline byte.mips.elf File opened for reading /proc/701/cmdline byte.mips.elf File opened for reading /proc/766/cmdline byte.mips.elf File opened for reading /proc/352/cmdline byte.mips.elf File opened for reading /proc/720/cmdline byte.mips.elf File opened for reading /proc/781/cmdline byte.mips.elf File opened for reading /proc/7/cmdline byte.mips.elf File opened for reading /proc/19/cmdline byte.mips.elf File opened for reading /proc/689/cmdline byte.mips.elf File opened for reading /proc/784/cmdline byte.mips.elf File opened for reading /proc/21/cmdline byte.mips.elf File opened for reading /proc/73/cmdline byte.mips.elf File opened for reading /proc/780/cmdline byte.mips.elf File opened for reading /proc/2/cmdline byte.mips.elf File opened for reading /proc/24/cmdline byte.mips.elf File opened for reading /proc/712/cmdline byte.mips.elf File opened for reading /proc/714/cmdline byte.mips.elf File opened for reading /proc/774/cmdline byte.mips.elf File opened for reading /proc/6/cmdline byte.mips.elf File opened for reading /proc/76/cmdline byte.mips.elf File opened for reading /proc/394/cmdline byte.mips.elf File opened for reading /proc/711/cmdline byte.mips.elf File opened for reading /proc/724/cmdline byte.mips.elf File opened for reading /proc/736/cmdline byte.mips.elf -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 698 byte.mips.elf