Analysis
- max time kernel
123s - max time network
144s - platform
debian-9_mips - resource
debian9-mipsbe-20251231-en - resource tags
arch:mipsimage:debian9-mipsbe-20251231-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
22/01/2026, 02:45
Static task
static1
Behavioral task
behavioral1
Sample
mips.elf
Resource
debian9-mipsbe-20251231-en
debian-9-mips
7 signatures
150 seconds
General
- Target mips.elf
- Size 86KB
- Sample260122-c8zzpsbx4c
- SHA256 2991389b73f7ecd13232aa10a5e48e1df2a67e142db2bb6cc58b17b73f0c6d7c
- MD5 3825c7763eeca1708988e2bfcb2a9d42
- SHA1 fee8b48a49f886c377d08a4bad944ed59ebff9a9
- SHA512 841d90f7b9e5ed35a3d4ca0265cda12ed27d703f2871665782bd55cc414a4125e41bd1800186f3e89b39c1c56e9949c77d89a7c8d82cb028e69bd3897966b2b5
- SSDEEP 1536:QGyzcKh1oNtJKWbQ86Wq5jkH7x8v3+IRejUR8Xh+Bugvt+JBT3MPQE:QGIcKbitX6W0jud1IRejUsh+sU+P3nE
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Renames itself 1 IoCs
pid Process 704 mips.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 48 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/7/maps mips.elf File opened for reading /proc/12/maps mips.elf File opened for reading /proc/14/maps mips.elf File opened for reading /proc/17/maps mips.elf File opened for reading /proc/24/maps mips.elf File opened for reading /proc/157/maps mips.elf File opened for reading /proc/5/maps mips.elf File opened for reading /proc/71/maps mips.elf File opened for reading /proc/72/maps mips.elf File opened for reading /proc/73/maps mips.elf File opened for reading /proc/117/maps mips.elf File opened for reading /proc/169/maps mips.elf File opened for reading /proc/8/maps mips.elf File opened for reading /proc/9/maps mips.elf File opened for reading /proc/10/maps mips.elf File opened for reading /proc/13/maps mips.elf File opened for reading /proc/15/maps mips.elf File opened for reading /proc/18/maps mips.elf File opened for reading /proc/23/maps mips.elf File opened for reading /proc/77/maps mips.elf File opened for reading /proc/4/maps mips.elf File opened for reading /proc/19/maps mips.elf File opened for reading /proc/22/maps mips.elf File opened for reading /proc/75/maps mips.elf File opened for reading /proc/151/maps mips.elf File opened for reading /proc/76/maps mips.elf File opened for reading /proc/348/maps mips.elf File opened for reading /proc/667/maps mips.elf File opened for reading /proc/694/maps mips.elf File opened for reading /proc/2/maps mips.elf File opened for reading /proc/11/maps mips.elf File opened for reading /proc/20/maps mips.elf File opened for reading /proc/21/maps mips.elf File opened for reading /proc/79/maps mips.elf File opened for reading /proc/108/maps mips.elf File opened for reading /proc/116/maps mips.elf File opened for reading /proc/70/maps mips.elf File opened for reading /proc/6/maps mips.elf File opened for reading /proc/36/maps mips.elf File opened for reading /proc/37/maps mips.elf File opened for reading /proc/74/maps mips.elf File opened for reading /proc/82/maps mips.elf File opened for reading /proc/1/maps mips.elf File opened for reading /proc/3/maps mips.elf File opened for reading /proc/16/maps mips.elf File opened for reading /proc/78/maps mips.elf File opened for reading /proc/145/maps mips.elf File opened for reading /proc/670/maps mips.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself udevd 704 mips.elf - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo mips.elf -
description ioc Process File opened for reading /proc/702/cmdline mips.elf File opened for reading /proc/736/cmdline mips.elf File opened for reading /proc/71/cmdline mips.elf File opened for reading /proc/1/cmdline mips.elf File opened for reading /proc/9/cmdline mips.elf File opened for reading /proc/733/cmdline mips.elf File opened for reading /proc/348/exe mips.elf File opened for reading /proc/749/cmdline mips.elf File opened for reading /proc/70/cmdline mips.elf File opened for reading /proc/5/cmdline mips.elf File opened for reading /proc/15/cmdline mips.elf File opened for reading /proc/19/cmdline mips.elf File opened for reading /proc/108/cmdline mips.elf File opened for reading /proc/719/cmdline mips.elf File opened for reading /proc/721/cmdline mips.elf File opened for reading /proc/738/cmdline mips.elf File opened for reading /proc/75/cmdline mips.elf File opened for reading /proc/730/cmdline mips.elf File opened for reading /proc/734/cmdline mips.elf File opened for reading /proc/753/cmdline mips.elf File opened for reading /proc/371/cmdline mips.elf File opened for reading /proc/7/cmdline mips.elf File opened for reading /proc/10/cmdline mips.elf File opened for reading /proc/78/cmdline mips.elf File opened for reading /proc/169/exe mips.elf File opened for reading /proc/754/cmdline mips.elf File opened for reading /proc/37/cmdline mips.elf File opened for reading /proc/2/cmdline mips.elf File opened for reading /proc/3/cmdline mips.elf File opened for reading /proc/6/cmdline mips.elf File opened for reading /proc/13/cmdline mips.elf File opened for reading /proc/24/cmdline mips.elf File opened for reading /proc/157/cmdline mips.elf File opened for reading /proc/752/cmdline mips.elf File opened for reading /proc/74/cmdline mips.elf File opened for reading /proc/145/cmdline mips.elf File opened for reading /proc/169/cmdline mips.elf File opened for reading /proc/748/cmdline mips.elf File opened for reading /proc/79/cmdline mips.elf File opened for reading /proc/727/cmdline mips.elf File opened for reading /proc/747/cmdline mips.elf File opened for reading /proc/352/cmdline mips.elf File opened for reading /proc/731/cmdline mips.elf File opened for reading /proc/11/cmdline mips.elf File opened for reading /proc/17/cmdline mips.elf File opened for reading /proc/23/cmdline mips.elf File opened for reading /proc/750/cmdline mips.elf File opened for reading /proc/76/cmdline mips.elf File opened for reading /proc/720/cmdline mips.elf File opened for reading /proc/723/cmdline mips.elf File opened for reading /proc/740/cmdline mips.elf File opened for reading /proc/117/cmdline mips.elf File opened for reading /proc/380/cmdline mips.elf File opened for reading /proc/12/cmdline mips.elf File opened for reading /proc/73/cmdline mips.elf File opened for reading /proc/703/cmdline mips.elf File opened for reading /proc/667/exe mips.elf File opened for reading /proc/349/cmdline mips.elf File opened for reading /proc/mounts mips.elf File opened for reading /proc/1/exe mips.elf File opened for reading /proc/743/cmdline mips.elf File opened for reading /proc/372/cmdline mips.elf File opened for reading /proc/725/cmdline mips.elf File opened for reading /proc/755/cmdline mips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 704 mips.elf