Analysis
- max time kernel
149s - max time network
151s - platform
debian-9_mipsel - resource
debian9-mipsel-20240611-en - resource tags
arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem - submitted
09/01/2025, 02:52
Static task
static1
Behavioral task
behavioral1
Sample
2.elf
Resource
debian9-mipsel-20240611-en
5 signatures
150 seconds
General
- Target 2.elf
- Size 102KB
- Sample250109-dcqa3axpcj
- SHA256 144d1a465511f24a1db9d9651873c8ac851cc7820628edc389d8c48c3039e030
- MD5 eb62d1f8e35144894c7fac46787f7758
- SHA1 6fee9cf2c3a967b4a7921e7bd2e63d78301890f7
- SHA512 363bf5c28dd8a0fd62febb18bef19ba1999d940e9bd759ba7bc24b67178c2308ced61be7b8c14bcd644a5e4e064c9bb5bab610ffae8f48920572a24f5c67805b
- SSDEEP 1536:kkhSIGkWOPHUlKPAaBVzJipVPzIdbBomljAdFvbTN0Jz9hnMtb:kkhSIGkFPH6KPtPopVtbg4
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Contacts a large (35319) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /bin/login 704 2.elf -
description ioc Process File opened for reading /proc/734/cmdline 2.elf File opened for reading /proc/772/cmdline 2.elf File opened for reading /proc/378/cmdline 2.elf File opened for reading /proc/705/cmdline 2.elf File opened for reading /proc/726/cmdline 2.elf File opened for reading /proc/774/cmdline 2.elf File opened for reading /proc/777/cmdline 2.elf File opened for reading /proc/246/cmdline 2.elf File opened for reading /proc/733/cmdline 2.elf File opened for reading /proc/746/cmdline 2.elf File opened for reading /proc/748/cmdline 2.elf File opened for reading /proc/676/cmdline 2.elf File opened for reading /proc/426/cmdline 2.elf File opened for reading /proc/675/cmdline 2.elf File opened for reading /proc/720/cmdline 2.elf File opened for reading /proc/736/cmdline 2.elf File opened for reading /proc/742/cmdline 2.elf File opened for reading /proc/773/cmdline 2.elf File opened for reading /proc/151/cmdline 2.elf File opened for reading /proc/754/cmdline 2.elf File opened for reading /proc/789/cmdline 2.elf File opened for reading /proc/800/cmdline 2.elf File opened for reading /proc/803/cmdline 2.elf File opened for reading /proc/356/cmdline 2.elf File opened for reading /proc/795/cmdline 2.elf File opened for reading /proc/719/cmdline 2.elf File opened for reading /proc/711/status 2.elf File opened for reading /proc/780/cmdline 2.elf File opened for reading /proc/792/cmdline 2.elf File opened for reading /proc/811/cmdline 2.elf File opened for reading /proc/self/maps 2.elf File opened for reading /proc/752/cmdline 2.elf File opened for reading /proc/808/cmdline 2.elf File opened for reading /proc/677/cmdline 2.elf File opened for reading /proc/735/cmdline 2.elf File opened for reading /proc/767/cmdline 2.elf File opened for reading /proc/794/cmdline 2.elf File opened for reading /proc/353/cmdline 2.elf File opened for reading /proc/743/cmdline 2.elf File opened for reading /proc/802/cmdline 2.elf File opened for reading /proc/809/cmdline 2.elf File opened for reading /proc/709/cmdline 2.elf File opened for reading /proc/779/cmdline 2.elf File opened for reading /proc/769/cmdline 2.elf File opened for reading /proc/716/cmdline 2.elf File opened for reading /proc/728/cmdline 2.elf File opened for reading /proc/749/cmdline 2.elf File opened for reading /proc/750/cmdline 2.elf File opened for reading /proc/764/cmdline 2.elf File opened for reading /proc/770/cmdline 2.elf File opened for reading /proc/810/cmdline 2.elf File opened for reading /proc/358/cmdline 2.elf File opened for reading /proc/724/cmdline 2.elf File opened for reading /proc/765/cmdline 2.elf File opened for reading /proc/786/cmdline 2.elf File opened for reading /proc/330/cmdline 2.elf File opened for reading /proc/706/cmdline 2.elf File opened for reading /proc/715/cmdline 2.elf File opened for reading /proc/755/cmdline 2.elf File opened for reading /proc/771/cmdline 2.elf File opened for reading /proc/796/cmdline 2.elf File opened for reading /proc/697/cmdline 2.elf File opened for reading /proc/670/cmdline 2.elf File opened for reading /proc/784/cmdline 2.elf