Analysis
- max time kernel
149s - max time network
151s - platform
debian-9_mips - resource
debian9-mipsbe-20251218-en - resource tags
arch:mipsimage:debian9-mipsbe-20251218-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
21/12/2025, 19:09
Static task
static1
Behavioral task
behavioral1
Sample
b2.elf
Resource
debian9-mipsbe-20251218-en
6 signatures
150 seconds
General
- Target b2.elf
- Size 106KB
- Sample251221-xt1mxabl2w
- SHA256 a2108a9b9b291ddd8d11d06e39d4543e57def83ccd1641bb29484615ce622c36
- MD5 c49c5590ac84b97dc228c0db2ccbfdc4
- SHA1 58696a849d87562dc295ffa57f2e65f52b8cb6fb
- SHA512 592282bec105916ac12892959a0b3ac367a8dffeccd22a66cced312d370ef756c53c064258918c02eebb0d411169ba429f670fb97d0209ac5b89d2375084c22f
- SSDEEP 1536:ao3HjDP7SzU7hOHNfTbPZelDncaLAnwKKA9GsPgXfMc1:ao3DDPiSalbhWncjm1
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Contacts a large (37849) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Deletes itself 1 IoCs
pid Process 704 b2.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself (sd-pam) 700 b2.elf -
description ioc Process File opened for reading /proc/730/cmdline b2.elf File opened for reading /proc/731/cmdline b2.elf File opened for reading /proc/740/cmdline b2.elf File opened for reading /proc/760/cmdline b2.elf File opened for reading /proc/795/cmdline b2.elf File opened for reading /proc/767/cmdline b2.elf File opened for reading /proc/791/cmdline b2.elf File opened for reading /proc/766/cmdline b2.elf File opened for reading /proc/803/cmdline b2.elf File opened for reading /proc/729/cmdline b2.elf File opened for reading /proc/742/cmdline b2.elf File opened for reading /proc/751/cmdline b2.elf File opened for reading /proc/796/cmdline b2.elf File opened for reading /proc/709/cmdline b2.elf File opened for reading /proc/728/cmdline b2.elf File opened for reading /proc/752/cmdline b2.elf File opened for reading /proc/763/cmdline b2.elf File opened for reading /proc/723/cmdline b2.elf File opened for reading /proc/735/cmdline b2.elf File opened for reading /proc/708/cmdline b2.elf File opened for reading /proc/251/cmdline b2.elf File opened for reading /proc/342/cmdline b2.elf File opened for reading /proc/646/cmdline b2.elf File opened for reading /proc/734/cmdline b2.elf File opened for reading /proc/786/cmdline b2.elf File opened for reading /proc/790/cmdline b2.elf File opened for reading /proc/793/cmdline b2.elf File opened for reading /proc/1/cmdline b2.elf File opened for reading /proc/336/cmdline b2.elf File opened for reading /proc/727/cmdline b2.elf File opened for reading /proc/733/cmdline b2.elf File opened for reading /proc/776/cmdline b2.elf File opened for reading /proc/792/cmdline b2.elf File opened for reading /proc/370/cmdline b2.elf File opened for reading /proc/153/cmdline b2.elf File opened for reading /proc/669/cmdline b2.elf File opened for reading /proc/724/cmdline b2.elf File opened for reading /proc/743/cmdline b2.elf File opened for reading /proc/5/cmdline b2.elf File opened for reading /proc/373/cmdline b2.elf File opened for reading /proc/662/cmdline b2.elf File opened for reading /proc/720/cmdline b2.elf File opened for reading /proc/339/cmdline b2.elf File opened for reading /proc/769/cmdline b2.elf File opened for reading /proc/772/cmdline b2.elf File opened for reading /proc/784/cmdline b2.elf File opened for reading /proc/712/cmdline b2.elf File opened for reading /proc/386/cmdline b2.elf File opened for reading /proc/719/cmdline b2.elf File opened for reading /proc/747/cmdline b2.elf File opened for reading /proc/762/cmdline b2.elf File opened for reading /proc/771/cmdline b2.elf File opened for reading /proc/773/cmdline b2.elf File opened for reading /proc/794/cmdline b2.elf File opened for reading /proc/765/cmdline b2.elf File opened for reading /proc/783/cmdline b2.elf File opened for reading /proc/797/cmdline b2.elf File opened for reading /proc/801/cmdline b2.elf File opened for reading /proc/806/cmdline b2.elf File opened for reading /proc/715/cmdline b2.elf File opened for reading /proc/749/cmdline b2.elf File opened for reading /proc/764/cmdline b2.elf File opened for reading /proc/770/cmdline b2.elf File opened for reading /proc/800/cmdline b2.elf