Analysis
-
max time kernel
150s -
max time network
154s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
13-01-2025 06:02
Behavioral task
behavioral1
Sample
byte.mips.elf
Resource
debian9-mipsbe-20240611-en
debian-9-mips
4 signatures
150 seconds
General
-
Target
byte.mips.elf
-
Size
104KB
-
MD5
0b337eb9a74fdd0d0f2006e4ed7f4c70
-
SHA1
d31c8c801601c935f0b96efb1dd6ecc47414e800
-
SHA256
37c2cc2b739fa0ac2045a11611032505dc10cb6b70525eaa084a066886fdf4c8
-
SHA512
ad0897247af3a62f1e9bfca9ddd95e8c4f27e7abc0bafb7f982aaf7a23aad3e14acaf7ee2cf1294a641e1e8bcf9f0db3b535179d1100aec4f8a90c096e517339
-
SSDEEP
1536:rWSIow5K0LU/RO1LwHVjShCL8kzmEmfrhdogZeB9il61d60qH:xCfU/ROtsjShCL8kzmEmfNdhGi4XqH
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog byte.mips.elf File opened for modification /dev/misc/watchdog byte.mips.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/81/cmdline byte.mips.elf File opened for reading /proc/675/cmdline byte.mips.elf File opened for reading /proc/709/cmdline byte.mips.elf File opened for reading /proc/717/cmdline byte.mips.elf File opened for reading /proc/733/cmdline byte.mips.elf File opened for reading /proc/743/cmdline byte.mips.elf File opened for reading /proc/17/cmdline byte.mips.elf File opened for reading /proc/3/cmdline byte.mips.elf File opened for reading /proc/73/cmdline byte.mips.elf File opened for reading /proc/224/cmdline byte.mips.elf File opened for reading /proc/768/cmdline byte.mips.elf File opened for reading /proc/772/cmdline byte.mips.elf File opened for reading /proc/773/cmdline byte.mips.elf File opened for reading /proc/24/cmdline byte.mips.elf File opened for reading /proc/225/cmdline byte.mips.elf File opened for reading /proc/458/cmdline byte.mips.elf File opened for reading /proc/728/cmdline byte.mips.elf File opened for reading /proc/731/cmdline byte.mips.elf File opened for reading /proc/764/cmdline byte.mips.elf File opened for reading /proc/70/cmdline byte.mips.elf File opened for reading /proc/147/cmdline byte.mips.elf File opened for reading /proc/711/cmdline byte.mips.elf File opened for reading /proc/732/cmdline byte.mips.elf File opened for reading /proc/757/cmdline byte.mips.elf File opened for reading /proc/771/cmdline byte.mips.elf File opened for reading /proc/708/cmdline byte.mips.elf File opened for reading /proc/112/cmdline byte.mips.elf File opened for reading /proc/316/cmdline byte.mips.elf File opened for reading /proc/700/cmdline byte.mips.elf File opened for reading /proc/776/cmdline byte.mips.elf File opened for reading /proc/2/cmdline byte.mips.elf File opened for reading /proc/72/cmdline byte.mips.elf File opened for reading /proc/104/cmdline byte.mips.elf File opened for reading /proc/724/cmdline byte.mips.elf File opened for reading /proc/689/cmdline byte.mips.elf File opened for reading /proc/701/cmdline byte.mips.elf File opened for reading /proc/745/cmdline byte.mips.elf File opened for reading /proc/751/cmdline byte.mips.elf File opened for reading /proc/746/cmdline byte.mips.elf File opened for reading /proc/18/cmdline byte.mips.elf File opened for reading /proc/23/cmdline byte.mips.elf File opened for reading /proc/67/cmdline byte.mips.elf File opened for reading /proc/68/cmdline byte.mips.elf File opened for reading /proc/74/cmdline byte.mips.elf File opened for reading /proc/694/cmdline byte.mips.elf File opened for reading /proc/489/cmdline byte.mips.elf File opened for reading /proc/698/cmdline byte.mips.elf File opened for reading /proc/749/cmdline byte.mips.elf File opened for reading /proc/750/cmdline byte.mips.elf File opened for reading /proc/765/cmdline byte.mips.elf File opened for reading /proc/730/cmdline byte.mips.elf File opened for reading /proc/7/cmdline byte.mips.elf File opened for reading /proc/8/cmdline byte.mips.elf File opened for reading /proc/721/cmdline byte.mips.elf File opened for reading /proc/487/cmdline byte.mips.elf File opened for reading /proc/710/cmdline byte.mips.elf File opened for reading /proc/718/cmdline byte.mips.elf File opened for reading /proc/725/cmdline byte.mips.elf File opened for reading /proc/372/cmdline byte.mips.elf File opened for reading /proc/767/cmdline byte.mips.elf File opened for reading /proc/11/cmdline byte.mips.elf File opened for reading /proc/12/cmdline byte.mips.elf File opened for reading /proc/10/cmdline byte.mips.elf File opened for reading /proc/78/cmdline byte.mips.elf -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 697 byte.mips.elf