Analysis
- max time kernel
110s - max time network
115s - platform
debian-12_mipsel - resource
debian12-mipsel-20240221-en - resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
04/02/2025, 03:07
Static task
static1
Behavioral task
behavioral1
Sample
b2.elf
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
4 signatures
150 seconds
General
- Target b2.elf
- Size 165KB
- Sample250204-dmembasqbx
- SHA256 8dcb961899c2d7be3bc3d812efc92006d1353433349ee7b873738ae1bd970c38
- MD5 9e3dd08afdebe8e76c2c09cc229a2e3d
- SHA1 98e55513642e1abbe3979e0570e4bf667b82a0d4
- SHA512 1bea706660179e3ce2cc5d5a7faea17250e7222a3ef187836b82a447c5db538b1025ba142d4b90e91a87749675f8d700579c072e7055a228ac1f87b1889f5c5d
- SSDEEP 1536:iKCAoXzPKNarPEjL+AsCoLNrfT/1kEl8TCxPwu+edf5ZDtQO8cH3HsY2s/edPGMr:iKCZPk+BCoLNrqGQ+MJs/ednr
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp b2.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp b2.elf -
description ioc Process File opened for reading /proc/356/cmdline b2.elf File opened for reading /proc/409/cmdline b2.elf File opened for reading /proc/768/cmdline b2.elf File opened for reading /proc/773/cmdline b2.elf File opened for reading /proc/785/cmdline b2.elf File opened for reading /proc/787/cmdline b2.elf File opened for reading /proc/391/cmdline b2.elf File opened for reading /proc/408/cmdline b2.elf File opened for reading /proc/680/cmdline b2.elf File opened for reading /proc/755/cmdline b2.elf File opened for reading /proc/771/cmdline b2.elf File opened for reading /proc/774/cmdline b2.elf File opened for reading /proc/396/cmdline b2.elf File opened for reading /proc/713/cmdline b2.elf File opened for reading /proc/stat b2.elf File opened for reading /proc/789/cmdline b2.elf File opened for reading /proc/380/cmdline b2.elf File opened for reading /proc/695/cmdline b2.elf File opened for reading /proc/697/cmdline b2.elf File opened for reading /proc/784/cmdline b2.elf File opened for reading /proc/180/cmdline b2.elf File opened for reading /proc/741/cmdline b2.elf File opened for reading /proc/744/cmdline b2.elf File opened for reading /proc/759/status b2.elf File opened for reading /proc/778/cmdline b2.elf File opened for reading /proc/782/cmdline b2.elf File opened for reading /proc/202/cmdline b2.elf File opened for reading /proc/377/cmdline b2.elf File opened for reading /proc/711/cmdline b2.elf File opened for reading /proc/752/cmdline b2.elf File opened for reading /proc/770/cmdline b2.elf File opened for reading /proc/775/cmdline b2.elf File opened for reading /proc/346/cmdline b2.elf File opened for reading /proc/679/cmdline b2.elf File opened for reading /proc/746/status b2.elf File opened for reading /proc/1/cmdline b2.elf File opened for reading /proc/758/cmdline b2.elf File opened for reading /proc/769/cmdline b2.elf File opened for reading /proc/779/cmdline b2.elf File opened for reading /proc/781/cmdline b2.elf File opened for reading /proc/786/cmdline b2.elf File opened for reading /proc/788/cmdline b2.elf File opened for reading /proc/783/cmdline b2.elf File opened for reading /proc/379/cmdline b2.elf File opened for reading /proc/424/cmdline b2.elf File opened for reading /proc/667/cmdline b2.elf File opened for reading /proc/710/cmdline b2.elf File opened for reading /proc/754/cmdline b2.elf File opened for reading /proc/756/cmdline b2.elf