Analysis
- max time kernel
122s - max time network
152s - platform
debian-9_mips - resource
debian9-mipsbe-20250619-en - resource tags
arch:mipsimage:debian9-mipsbe-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
29/10/2025, 02:45
Behavioral task
behavioral1
Sample
pmips.elf
Resource
debian9-mipsbe-20250619-en
debian-9-mips
7 signatures
150 seconds
General
- Target pmips.elf
- Size 58KB
- Sample251029-c8phzaspcr
- SHA256 e35911fc3d3535bf2699c56ba414a160d792ea8dd9e1edd4c0bf7ce1e429db09
- MD5 1170655a88f644169b2fb42d3472af05
- SHA1 cb8ba469d84f744e526f3703477133b9e75c0255
- SHA512 55e93c9a0f5b67c89f5d7fe0c7f114b4b8c81ed48546d7d21896473ec93b4ef79e53d5a21b161e5843ad014e9e327e8263329dfb78559ac37f4dba69efc0c33c
- SSDEEP 1536:Cc5Ft+uwcwdXEMl1ECehLJ7A1tuP5VJu8N:Cc5bsZdUQXeMIVQ+
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Mirai family
- Deletes itself 1 IoCs
pid Process 703 pmips.elf - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog pmips.elf File opened for modification /dev/misc/watchdog pmips.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself d85vu6fm7ca1plft8nqb 703 pmips.elf -
description ioc Process File opened for reading /proc/795cmdline pmips.elf File opened for reading /proc/812cmdline pmips.elf File opened for reading /proc/18cmdline pmips.elf File opened for reading /proc/320cmdline pmips.elf File opened for reading /proc/721cmdline pmips.elf File opened for reading /proc/754cmdline pmips.elf File opened for reading /proc/77cmdline pmips.elf File opened for reading /proc/712cmdline pmips.elf File opened for reading /proc/748cmdline pmips.elf File opened for reading /proc/749cmdline pmips.elf File opened for reading /proc/760cmdline pmips.elf File opened for reading /proc/775cmdline pmips.elf File opened for reading /proc/22cmdline pmips.elf File opened for reading /proc/81cmdline pmips.elf File opened for reading /proc/109cmdline pmips.elf File opened for reading /proc/349cmdline pmips.elf File opened for reading /proc/700cmdline pmips.elf File opened for reading /proc/741cmdline pmips.elf File opened for reading /proc/755cmdline pmips.elf File opened for reading /proc/805cmdline pmips.elf File opened for reading /proc/80cmdline pmips.elf File opened for reading /proc/675cmdline pmips.elf File opened for reading /proc/773cmdline pmips.elf File opened for reading /proc/802cmdline pmips.elf File opened for reading /proc/36cmdline pmips.elf File opened for reading /proc/745cmdline pmips.elf File opened for reading /proc/767cmdline pmips.elf File opened for reading /proc/770cmdline pmips.elf File opened for reading /proc/778cmdline pmips.elf File opened for reading /proc/791cmdline pmips.elf File opened for reading /proc/10cmdline pmips.elf File opened for reading /proc/75cmdline pmips.elf File opened for reading /proc/15cmdline pmips.elf File opened for reading /proc/717cmdline pmips.elf File opened for reading /proc/740cmdline pmips.elf File opened for reading /proc/772cmdline pmips.elf File opened for reading /proc/780cmdline pmips.elf File opened for reading /proc/784cmdline pmips.elf File opened for reading /proc/666cmdline pmips.elf File opened for reading /proc/676cmdline pmips.elf File opened for reading /proc/783cmdline pmips.elf File opened for reading /proc/794cmdline pmips.elf File opened for reading /proc/807cmdline pmips.elf File opened for reading /proc/809cmdline pmips.elf File opened for reading /proc/167cmdline pmips.elf File opened for reading /proc/800cmdline pmips.elf File opened for reading /proc/801cmdline pmips.elf File opened for reading /proc/704cmdline pmips.elf File opened for reading /proc/709cmdline pmips.elf File opened for reading /proc/713cmdline pmips.elf File opened for reading /proc/736cmdline pmips.elf File opened for reading /proc/737cmdline pmips.elf File opened for reading /proc/750cmdline pmips.elf File opened for reading /proc/751cmdline pmips.elf File opened for reading /proc/757cmdline pmips.elf File opened for reading /proc/379cmdline pmips.elf File opened for reading /proc/738cmdline pmips.elf File opened for reading /proc/762cmdline pmips.elf File opened for reading /proc/768cmdline pmips.elf File opened for reading /proc/777cmdline pmips.elf File opened for reading /proc/781cmdline pmips.elf File opened for reading /proc/799cmdline pmips.elf File opened for reading /proc/816cmdline pmips.elf File opened for reading /proc/348cmdline pmips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 703 pmips.elf