c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099 | Triage

Resubmissions

02-01-2025 21:33

250102-1ejbvswpcv 10

08-12-2024 01:12

241208-bkq68azkep 10

Analysis

max time kernel
150s
max time network
162s
platform
debian-12_mipsel
resource
debian12-mipsel-20240221-en
resource tags

arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
02-01-2025 21:33

Sharing

Report Analysis Logs

General

Target

mips
Size

1.1MB
MD5

a883bae381125e862c109af67b3cfda4
SHA1

852f169460932eb49c13fb6050fcdbafcd354af9
SHA256

5d9f4ec734cf44f342a45f7de4ba0e208ec141ce47e32b3bc7d0666eff538fe5
SHA512

40a9804c5f900c3370ac856172c496347faec0187489c9e5d496923dc27f7b2138bfa2c43550acab44fb331ced5e2993fe84ff737f87275fbb74a4eb7b502738
SSDEEP

12288:v0gZjw/mGyri7g8Nyllxm+KYCy1aPrfWf47b/d+qdeaQklaHhmM7tL+GSPlXJZra:VETLPAFHcMJ6l5ZZVtGAi3YKhAxtK

Score

4^/10

discovery

Malware Config

Signatures

Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	mips

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

Internet Connection Discovery

description	ioc	Process
File opened for reading	/proc/net/dev	mips

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/stat	mips
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed

System Network Configuration Discovery 1 TTPs 9 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

pid	Process
788	sh
789	sed
791	sed
784	sh
785	sed
787	sed
773	mips
786	sh
790	sh

/tmp/mips
/tmp/mips
1⤵
- Reads CPU attributes
- Reads system network configuration
- Reads runtime system information
- System Network Configuration Discovery
PID:773
- /bin/sh
  sh -c "sed -i -e '/exit/d' /etc/rc.local"
  2⤵
  PID:775
- - /usr/bin/sed
    sed -i -e /exit/d /etc/rc.local
    3⤵
    - Reads runtime system information
    PID:776
- /bin/sh
  sh -c "sed -i -e '/^ | | \$/d' /etc/rc.local"
  2⤵
  PID:778
- - /usr/bin/sed
    sed -i -e "/^ | | \$/d" /etc/rc.local
    3⤵
    - Reads runtime system information
    PID:780
- /bin/sh
  sh -c "sed -i -e '/mips reboot/d' /etc/rc.local"
  2⤵
  - System Network Configuration Discovery
  PID:784
- - /usr/bin/sed
    sed -i -e "/mips reboot/d" /etc/rc.local
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:785
- /bin/sh
  sh -c "sed -i -e '2 i/tmp/mips reboot' /etc/rc.local"
  2⤵
  - System Network Configuration Discovery
  PID:786
- - /usr/bin/sed
    sed -i -e "2 i/tmp/mips reboot" /etc/rc.local
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:787
- /bin/sh
  sh -c "sed -i -e '2 i/tmp/mips reboot start' /etc/rc.d/rc.local"
  2⤵
  - System Network Configuration Discovery
  PID:788
- - /usr/bin/sed
    sed -i -e "2 i/tmp/mips reboot start" /etc/rc.d/rc.local
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:789
- /bin/sh
  sh -c "sed -i -e '2 i/tmp/mips reboot start' /etc/init.d/boot.local"
  2⤵
  - System Network Configuration Discovery
  PID:790
- - /usr/bin/sed
    sed -i -e "2 i/tmp/mips reboot start" /etc/init.d/boot.local
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:791

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads