Analysis
- max time kernel
90s - max time network
2s - platform
debian-9_mips - resource
debian9-mipsbe-20250619-en - resource tags
- submitted
10/09/2025, 09:59
General
- Target sshd.elf
- Size 179KB
- Sample250910-l1bftaxpy4
- SHA256 ae93d820fb2fd9ec80de19f11ef6254b741d96de849f449ef664334e410eb8a6
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
- Changes its process name 1 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/sshd.elf/tmp/sshd.elf1⤵
- Modifies Watchdog functionality
- Reads system routing table
- Changes its process name
- Checks CPU configuration
- Reads system network configuration