Analysis
- max time kernel
150s - max time network
154s - platform
debian-12_mipsel - resource
debian12-mipsel-20250619-en - resource tags
arch:mipselimage:debian12-mipsel-20250619-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
11/08/2025, 00:44
Static task
static1
Behavioral task
behavioral1
Sample
mipsel.elf
Resource
debian12-mipsel-20250619-en
debian-12-mipsel
6 signatures
150 seconds
General
- Target mipsel.elf
- Size 214KB
- Sample250811-a3p67syscw
- SHA256 e09f5d4b38e04b9e16a03876f881ce91baddc435fcdda0eece8f65d6f9724020
- MD5 1700a658018eee1000fb90f541e75c5e
- SHA1 0db962b5dc5e884055d7d1f23ebb3f313485e388
- SHA512 07fd25deb16af93703d8271c5696c8be4b633a95ba6b65e1174989ce7b284eb7f92654fc016150f2a51826589d86ba35df84aff8a54baf9ef36209f8f7daa272
- SSDEEP 3072:hBFPTdg/NqF5N6Cnej06ORaossEblivuWCMY/4xS6982:I1qFSN0fRaqE4VY/cS698
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 795 mipsel.elf - Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/xs.main mipsel.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself -sh 795 mipsel.elf -
description ioc Process File opened for reading /proc/842/cmdline mipsel.elf File opened for reading /proc/879/cmdline mipsel.elf File opened for reading /proc/9/status mipsel.elf File opened for reading /proc/112/cmdline mipsel.elf File opened for reading /proc/832/status mipsel.elf File opened for reading /proc/22/comm mipsel.elf File opened for reading /proc/378/comm mipsel.elf File opened for reading /proc/754/comm mipsel.elf File opened for reading /proc/137/status mipsel.elf File opened for reading /proc/847/comm mipsel.elf File opened for reading /proc/29/comm mipsel.elf File opened for reading /proc/45/status mipsel.elf File opened for reading /proc/811/status mipsel.elf File opened for reading /proc/402/cmdline mipsel.elf File opened for reading /proc/855/cmdline mipsel.elf File opened for reading /proc/856/comm mipsel.elf File opened for reading /proc/893/comm mipsel.elf File opened for reading /proc/912/status mipsel.elf File opened for reading /proc/12/comm mipsel.elf File opened for reading /proc/3/comm mipsel.elf File opened for reading /proc/852/status mipsel.elf File opened for reading /proc/47/comm mipsel.elf File opened for reading /proc/404/status mipsel.elf File opened for reading /proc/812/status mipsel.elf File opened for reading /proc/836/status mipsel.elf File opened for reading /proc/838/status mipsel.elf File opened for reading /proc/824/comm mipsel.elf File opened for reading /proc/24/comm mipsel.elf File opened for reading /proc/33/comm mipsel.elf File opened for reading /proc/37/comm mipsel.elf File opened for reading /proc/802/status mipsel.elf File opened for reading /proc/848/comm mipsel.elf File opened for reading /proc/860/cmdline mipsel.elf File opened for reading /proc/884/cmdline mipsel.elf File opened for reading /proc/388/comm mipsel.elf File opened for reading /proc/13/status mipsel.elf File opened for reading /proc/694/status mipsel.elf File opened for reading /proc/831/status mipsel.elf File opened for reading /proc/841/cmdline mipsel.elf File opened for reading /proc/856/status mipsel.elf File opened for reading /proc/862/comm mipsel.elf File opened for reading /proc/884/status mipsel.elf File opened for reading /proc/5/comm mipsel.elf File opened for reading /proc/332/status mipsel.elf File opened for reading /proc/818/cmdline mipsel.elf File opened for reading /proc/889/status mipsel.elf File opened for reading /proc/4/comm mipsel.elf File opened for reading /proc/11/comm mipsel.elf File opened for reading /proc/376/comm mipsel.elf File opened for reading /proc/114/status mipsel.elf File opened for reading /proc/767/status mipsel.elf File opened for reading /proc/846/cmdline mipsel.elf File opened for reading /proc/915/cmdline mipsel.elf File opened for reading /proc/42/comm mipsel.elf File opened for reading /proc/801/cmdline mipsel.elf File opened for reading /proc/854/status mipsel.elf File opened for reading /proc/7/status mipsel.elf File opened for reading /proc/8/status mipsel.elf File opened for reading /proc/17/status mipsel.elf File opened for reading /proc/22/status mipsel.elf File opened for reading /proc/783/status mipsel.elf File opened for reading /proc/118/cmdline mipsel.elf File opened for reading /proc/332/cmdline mipsel.elf File opened for reading /proc/13/comm mipsel.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 792 mipsel.elf
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/init.d/xs.main
- Size 22B
- SHA256 e7678c30c8b78d38c928b586c946dc61e0858b7ce6c48ec6eefdaea79c9be996
- MD5 034fb1d5ede97735588b7b51cc567509
- SHA1 e18e2f383d7b378278ced67d8ae17b023a65ecb7
- SHA512 4e378c74cc212feb02d3b32a4bfff3dd6707e8e1d608370eeaa7f725123a42e5baee218d1836af982caaca8a053dc5c781c758941a6fe699935d8238b1ff46be
- MD5 SHA1 SHA512
- Path /var/main
- Size 214KB
- SHA256 e09f5d4b38e04b9e16a03876f881ce91baddc435fcdda0eece8f65d6f9724020
- MD5 1700a658018eee1000fb90f541e75c5e
- SHA1 0db962b5dc5e884055d7d1f23ebb3f313485e388
- SHA512 07fd25deb16af93703d8271c5696c8be4b633a95ba6b65e1174989ce7b284eb7f92654fc016150f2a51826589d86ba35df84aff8a54baf9ef36209f8f7daa272
- SSDEEP 3072:hBFPTdg/NqF5N6Cnej06ORaossEblivuWCMY/4xS6982:I1qFSN0fRaqE4VY/cS698
- MD5 SHA1 SHA512 SSDEEP