Analysis
- max time kernel
149s - max time network
150s - platform
debian-9_mips - resource
debian9-mipsbe-20240729-en - resource tags
arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
25/01/2025, 17:03
Behavioral task
behavioral1
Sample
main_mips.elf
Resource
debian9-mipsbe-20240729-en
5 signatures
150 seconds
General
- Target main_mips.elf
- Size 169KB
- Sample250125-vkn7easkgt
- SHA256 548cd4c3e6d0b344d823deb850206bba6792122f70a7bf75c5aa5fc89a33a18a
- MD5 81a99470c24134aadb86691f1641a0f3
- SHA1 95d317308609dbf89c25e3adb1fea0db03af2f85
- SHA512 777cc417912aee02324f385acd7014fee0e268a00f19ba47ced5600a3a18d28c329f045f9a37910fc1dcb62a3a6d3053d316f4315794475b686e665d6c88ebc5
- SSDEEP 3072:jg57RN7LHZwbq1YSBan1yvbysxr1uGSHI:jglRN7LHZ0Bqyy1BSHI
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 737 main_mips.elf - Traces itself 2 IoCs
Traces itself to prevent debugging attempts
pid Process 737 main_mips.elf 738 main_mips.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 737 main_mips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 737 main_mips.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/main_mips.elf main_mips.elf