496de4fa27abbb7f657899e5026c099f4586948f233ab3d1b6c878d13c28c7e5

Analysis

max time kernel
149s
max time network
147s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
11/01/2025, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mips.elf
Size

78KB
MD5

b30def198c7c980b410aca4039add0ba
SHA1

8f8dfb442709c7773d626c4a6dc7e1b6d64cccf4
SHA256

496de4fa27abbb7f657899e5026c099f4586948f233ab3d1b6c878d13c28c7e5
SHA512

ac030e4f2bf2480475fdba11fa5240af740bd7f544e70b658d05c05c0b1ce87348628fd4e4ebd4a8a2e58d1c1850871e32d1bcd85e6371ed76f77ce8c6c4536e
SSDEEP

1536:7KnNK+T1Qr7yJkuNdMCWnCWjSWWrNmyxiudxPuhe9flDi:7m9T1+7mNmxubPuglDi

Score

7^/10

discovery

Malware Config

Signatures

Renames itself 1 IoCs

pid	Process
706	mips.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/sbin/procd	706	mips.elf

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/719/status	mips.elf
File opened for reading	/proc/720/status	mips.elf
File opened for reading	/proc/699/cmdline	mips.elf
File opened for reading	/proc/712/status	mips.elf
File opened for reading	/proc/2/cmdline	mips.elf
File opened for reading	/proc/713/status	mips.elf
File opened for reading	/proc/713/cmdline	mips.elf
File opened for reading	/proc/718/status	mips.elf
File opened for reading	/proc/710/status	mips.elf
File opened for reading	/proc/711/status	mips.elf
File opened for reading	/proc/1/cmdline	mips.elf
File opened for reading	/proc/717/status	mips.elf

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
706	mips.elf

/tmp/mips.elf
/tmp/mips.elf
1⤵
- Renames itself
- Changes its process name
- Reads runtime system information
- System Network Configuration Discovery
PID:706

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads