Analysis
- max time kernel
39s - max time network
151s - platform
debian-9_mips - resource
debian9-mipsbe-20250619-en - resource tags
arch:mipsimage:debian9-mipsbe-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
20/10/2025, 03:58
Static task
static1
Behavioral task
behavioral1
Sample
mips.elf
Resource
debian9-mipsbe-20250619-en
debian-9-mips
7 signatures
150 seconds
General
- Target mips.elf
- Size 249KB
- Sample251020-ejznradt5f
- SHA256 48c570152390e90bd89c12e37a59feb7cbcccd1fd03dc270dc4c1214053ac722
- MD5 e1e8fefd0dab675c59388d6d04c7a566
- SHA1 f578baca4ff29a32cf3e0156f527461e3b377f26
- SHA512 928471e78eecd70adb22182ceb2f0ee2ec5620edf42aeaed7b18a788fb92c52df9f1f316647b1d31a9a39bf8366afec9578247cd11fc20315e6c569a781293d9
- SSDEEP 3072:9As0kWgNwAga5HSFnzbQAdL4ayHgBTvi2cPnNMBvtNwRECW4vJt:6sHSOHSFwAdL0APgSBDwRzW4v
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Contacts a large (188621) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Renames itself 1 IoCs
pid Process 711 mips.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /bin/busybox ntpd 711 mips.elf -
description ioc Process File opened for reading /proc/77/fd mips.elf File opened for reading /proc/125/stat mips.elf File opened for reading /proc/126/fd mips.elf File opened for reading /proc/160/stat mips.elf File opened for reading /proc/358/fd mips.elf File opened for reading /proc/440/stat mips.elf File opened for reading /proc/707/stat mips.elf File opened for reading /proc/720/status mips.elf File opened for reading /proc/674/fd mips.elf File opened for reading /proc/679/fd mips.elf File opened for reading /proc/715/fd mips.elf File opened for reading /proc/725/status mips.elf File opened for reading /proc/17/stat mips.elf File opened for reading /proc/160/fd mips.elf File opened for reading /proc/712/stat mips.elf File opened for reading /proc/10/stat mips.elf File opened for reading /proc/21/stat mips.elf File opened for reading /proc/109/fd mips.elf File opened for reading /proc/387/stat mips.elf File opened for reading /proc/707/fd mips.elf File opened for reading /proc/712/fd mips.elf File opened for reading /proc/713/fd mips.elf File opened for reading /proc/716/fd mips.elf File opened for reading /proc/12/fd mips.elf File opened for reading /proc/18/fd mips.elf File opened for reading /proc/703/stat mips.elf File opened for reading /proc/719/stat mips.elf File opened for reading /proc/2/cmdline mips.elf File opened for reading /proc/37/stat mips.elf File opened for reading /proc/12/stat mips.elf File opened for reading /proc/719/status mips.elf File opened for reading /proc/7/stat mips.elf File opened for reading /proc/7/fd mips.elf File opened for reading /proc/79/stat mips.elf File opened for reading /proc/724/status mips.elf File opened for reading /proc/718/status mips.elf File opened for reading /proc/13/fd mips.elf File opened for reading /proc/24/stat mips.elf File opened for reading /proc/729/status mips.elf File opened for reading /proc/1/cmdline mips.elf File opened for reading /proc/71/stat mips.elf File opened for reading /proc/356/fd mips.elf File opened for reading /proc/19/stat mips.elf File opened for reading /proc/77/stat mips.elf File opened for reading /proc/356/stat mips.elf File opened for reading /proc/708/stat mips.elf File opened for reading /proc/8/fd mips.elf File opened for reading /proc/19/fd mips.elf File opened for reading /proc/69/stat mips.elf File opened for reading /proc/73/stat mips.elf File opened for reading /proc/75/fd mips.elf File opened for reading /proc/714/status mips.elf File opened for reading /proc/4/fd mips.elf File opened for reading /proc/15/fd mips.elf File opened for reading /proc/76/stat mips.elf File opened for reading /proc/5/stat mips.elf File opened for reading /proc/18/stat mips.elf File opened for reading /proc/20/fd mips.elf File opened for reading /proc/21/fd mips.elf File opened for reading /proc/80/stat mips.elf File opened for reading /proc/726/status mips.elf File opened for reading /proc/126/stat mips.elf File opened for reading /proc/717/fd mips.elf File opened for reading /proc/718/stat mips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 711 mips.elf