Analysis
- max time kernel
150s - max time network
152s - platform
debian-9_mips - resource
debian9-mipsbe-20250619-en - resource tags
arch:mipsimage:debian9-mipsbe-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
22/10/2025, 23:48
Static task
static1
Behavioral task
behavioral1
Sample
mips.elf
Resource
debian9-mipsbe-20250619-en
debian-9-mips
8 signatures
150 seconds
General
- Target mips.elf
- Size 235KB
- Sample251022-3trynacy3c
- SHA256 4c6748f9c3235d9a9ad41ed8bb6e007caa446c33a9d8f7d3253554df84e4c935
- MD5 2adb25f53cb5222f18e721990ae895d9
- SHA1 612c90575b6ba568ce5babccf36b17430aa873e7
- SHA512 df6cb17210eaccd591ee699b4deefa0edcd60c961e636cb12d8ebf68aecab89f2831d9d0769d0ac2b7310b613031f648922335923a77045fee1a561a54b58a21
- SSDEEP 3072:zYx06WXdc8URBzVQbL6IhxGyWZ1pPEiJODkC239IL9BDjt:zRXqRBza6I1qf7Jm923qL9B9
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Contacts a large (36602) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Deletes itself 1 IoCs
pid Process 709 mips.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 27 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/377/maps mips.elf File opened for reading /proc/434/maps mips.elf File opened for reading /proc/659/maps mips.elf File opened for reading /proc/153/maps mips.elf File opened for reading /proc/175/maps mips.elf File opened for reading /proc/248/maps mips.elf File opened for reading /proc/685/maps mips.elf File opened for reading /proc/703/maps mips.elf File opened for reading /proc/378/maps mips.elf File opened for reading /proc/686/maps mips.elf File opened for reading /proc/701/maps mips.elf File opened for reading /proc/710/maps mips.elf File opened for reading /proc/713/maps mips.elf File opened for reading /proc/716/maps mips.elf File opened for reading /proc/719/maps mips.elf File opened for reading /proc/727/maps mips.elf File opened for reading /proc/331/maps mips.elf File opened for reading /proc/336/maps mips.elf File opened for reading /proc/337/maps mips.elf File opened for reading /proc/338/maps mips.elf File opened for reading /proc/365/maps mips.elf File opened for reading /proc/702/maps mips.elf File opened for reading /proc/717/maps mips.elf File opened for reading /proc/334/maps mips.elf File opened for reading /proc/385/maps mips.elf File opened for reading /proc/715/maps mips.elf File opened for reading /proc/718/maps mips.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /bin/busybox telentd 709 mips.elf -
description ioc Process File opened for reading /proc/124/stat mips.elf File opened for reading /proc/378/fd mips.elf File opened for reading /proc/659/fd mips.elf File opened for reading /proc/706/stat mips.elf File opened for reading /proc/740/stat mips.elf File opened for reading /proc/740/fd mips.elf File opened for reading /proc/7/stat mips.elf File opened for reading /proc/7/fd mips.elf File opened for reading /proc/69/stat mips.elf File opened for reading /proc/77/stat mips.elf File opened for reading /proc/740/status mips.elf File opened for reading /proc/19/stat mips.elf File opened for reading /proc/20/fd mips.elf File opened for reading /proc/24/fd mips.elf File opened for reading /proc/742/status mips.elf File opened for reading /proc/22/stat mips.elf File opened for reading /proc/124/fd mips.elf File opened for reading /proc/331/stat mips.elf File opened for reading /proc/331/fd mips.elf File opened for reading /proc/740/cmdline mips.elf File opened for reading /proc/6/fd mips.elf File opened for reading /proc/8/fd mips.elf File opened for reading /proc/15/fd mips.elf File opened for reading /proc/17/fd mips.elf File opened for reading /proc/73/stat mips.elf File opened for reading /proc/76/stat mips.elf File opened for reading /proc/708/stat mips.elf File opened for reading /proc/728/stat mips.elf File opened for reading /proc/731/cmdline mips.elf File opened for reading /proc/123/fd mips.elf File opened for reading /proc/4/stat mips.elf File opened for reading /proc/8/stat mips.elf File opened for reading /proc/10/stat mips.elf File opened for reading /proc/12/fd mips.elf File opened for reading /proc/74/fd mips.elf File opened for reading /proc/11/fd mips.elf File opened for reading /proc/72/fd mips.elf File opened for reading /proc/110/stat mips.elf File opened for reading /proc/377/fd mips.elf File opened for reading /proc/734/fd mips.elf File opened for reading /proc/82/stat mips.elf File opened for reading /proc/334/stat mips.elf File opened for reading /proc/686/fd mips.elf File opened for reading /proc/74/stat mips.elf File opened for reading /proc/79/fd mips.elf File opened for reading /proc/80/stat mips.elf File opened for reading /proc/123/stat mips.elf File opened for reading /proc/678/stat mips.elf File opened for reading /proc/730/status mips.elf File opened for reading /proc/9/fd mips.elf File opened for reading /proc/19/fd mips.elf File opened for reading /proc/365/fd mips.elf File opened for reading /proc/685/fd mips.elf File opened for reading /proc/728/fd mips.elf File opened for reading /proc/713/cmdline mips.elf File opened for reading /proc/4/fd mips.elf File opened for reading /proc/14/stat mips.elf File opened for reading /proc/248/stat mips.elf File opened for reading /proc/248/fd mips.elf File opened for reading /proc/336/fd mips.elf File opened for reading /proc/701/stat mips.elf File opened for reading /proc/729/fd mips.elf File opened for reading /proc/12/stat mips.elf File opened for reading /proc/36/fd mips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 709 mips.elf