Analysis
- max time kernel
123s - max time network
140s - platform
debian-9_mips - resource
debian9-mipsbe-20260127-en - resource tags
arch:mipsimage:debian9-mipsbe-20260127-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
04/04/2026, 04:30
Static task
static1
Behavioral task
behavioral1
Sample
data.mips.elf
Resource
debian9-mipsbe-20260127-en
debian-9-mips
8 signatures
150 seconds
General
- Target data.mips.elf
- Size 149KB
- Sample260404-e437nsay6v
- SHA256 d468b6ada8e3dcbfa91c708de4fe1ca3e41bbe18b2f5af2054a2e0a5686fdc9d
- MD5 2246a5b13d268e0be3e0bd6e985ef710
- SHA1 422d4767fc8b688c71c1df06b27ab7b2115e37ac
- SHA512 d4625af670cce59d35d363a42e9e87b79cedcf31313854ce97042ec747db03a79ca74726aecc782c782998420165fcf790dd3f8e84eee2eff5f7ed7bbb261a07
- SSDEEP 3072:cwLa8TPXxIJSkWGiJqHcy40abEnJvlTcH2al:cwLNLxIJSTGwqHgz+JaWal
- TLSH T1FBE3970A7E228F7EF269877447F38E31975877D616E1C680E1ACE5401F602CE645FBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp data.mips.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/361/maps data.mips.elf File opened for reading /proc/14/maps data.mips.elf File opened for reading /proc/16/maps data.mips.elf File opened for reading /proc/17/maps data.mips.elf File opened for reading /proc/24/maps data.mips.elf File opened for reading /proc/235/maps data.mips.elf File opened for reading /proc/335/maps data.mips.elf File opened for reading /proc/11/maps data.mips.elf File opened for reading /proc/717/maps data.mips.elf File opened for reading /proc/667/maps data.mips.elf File opened for reading /proc/782/maps data.mips.elf File opened for reading /proc/4/maps data.mips.elf File opened for reading /proc/19/maps data.mips.elf File opened for reading /proc/705/maps data.mips.elf File opened for reading /proc/711/maps data.mips.elf File opened for reading /proc/770/maps data.mips.elf File opened for reading /proc/13/maps data.mips.elf File opened for reading /proc/20/maps data.mips.elf File opened for reading /proc/37/maps data.mips.elf File opened for reading /proc/74/maps data.mips.elf File opened for reading /proc/12/maps data.mips.elf File opened for reading /proc/2/maps data.mips.elf File opened for reading /proc/334/maps data.mips.elf File opened for reading /proc/378/maps data.mips.elf File opened for reading /proc/665/maps data.mips.elf File opened for reading /proc/700/maps data.mips.elf File opened for reading /proc/9/maps data.mips.elf File opened for reading /proc/21/maps data.mips.elf File opened for reading /proc/36/maps data.mips.elf File opened for reading /proc/120/maps data.mips.elf File opened for reading /proc/382/maps data.mips.elf File opened for reading /proc/719/maps data.mips.elf File opened for reading /proc/76/maps data.mips.elf File opened for reading /proc/707/maps data.mips.elf File opened for reading /proc/8/maps data.mips.elf File opened for reading /proc/15/maps data.mips.elf File opened for reading /proc/18/maps data.mips.elf File opened for reading /proc/657/maps data.mips.elf File opened for reading /proc/78/maps data.mips.elf File opened for reading /proc/121/maps data.mips.elf File opened for reading /proc/3/maps data.mips.elf File opened for reading /proc/7/maps data.mips.elf File opened for reading /proc/675/maps data.mips.elf File opened for reading /proc/22/maps data.mips.elf File opened for reading /proc/169/maps data.mips.elf File opened for reading /proc/331/maps data.mips.elf File opened for reading /proc/774/maps data.mips.elf File opened for reading /proc/708/maps data.mips.elf File opened for reading /proc/70/maps data.mips.elf File opened for reading /proc/75/maps data.mips.elf File opened for reading /proc/424/maps data.mips.elf File opened for reading /proc/713/maps data.mips.elf File opened for reading /proc/6/maps data.mips.elf File opened for reading /proc/673/maps data.mips.elf File opened for reading /proc/5/maps data.mips.elf File opened for reading /proc/23/maps data.mips.elf File opened for reading /proc/73/maps data.mips.elf File opened for reading /proc/77/maps data.mips.elf File opened for reading /proc/82/maps data.mips.elf File opened for reading /proc/155/maps data.mips.elf File opened for reading /proc/722/maps data.mips.elf File opened for reading /proc/10/maps data.mips.elf File opened for reading /proc/109/maps data.mips.elf File opened for reading /proc/246/maps data.mips.elf - Changes its process name 3 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself watchdog/0 713 data.mips.elf Changes the process name, possibly in an attempt to hide itself cpuhp/2 713 data.mips.elf Changes the process name, possibly in an attempt to hide itself irqbalance 716 data.mips.elf - Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp data.mips.elf File opened for reading /proc/net/tcp6 data.mips.elf -
description ioc Process File opened for reading /proc/1/fd data.mips.elf File opened for reading /proc/8/cmdline data.mips.elf File opened for reading /proc/72/cmdline data.mips.elf File opened for reading /proc/4/cmdline data.mips.elf File opened for reading /proc/21/stat data.mips.elf File opened for reading /proc/331/cmdline data.mips.elf File opened for reading /proc/17/stat data.mips.elf File opened for reading /proc/11/cmdline data.mips.elf File opened for reading /proc/82/cmdline data.mips.elf File opened for reading /proc/705/cmdline data.mips.elf File opened for reading /proc/770/comm data.mips.elf File opened for reading /proc/774/fd data.mips.elf File opened for reading /proc/77/fd data.mips.elf File opened for reading /proc/5/stat data.mips.elf File opened for reading /proc/7/cmdline data.mips.elf File opened for reading /proc/11/stat data.mips.elf File opened for reading /proc/12/comm data.mips.elf File opened for reading /proc/80/comm data.mips.elf File opened for reading /proc/120/comm data.mips.elf File opened for reading /proc/713/cmdline data.mips.elf File opened for reading /proc/722/comm data.mips.elf File opened for reading /proc/10/stat data.mips.elf File opened for reading /proc/77/cmdline data.mips.elf File opened for reading /proc/120/stat data.mips.elf File opened for reading /proc/9/stat data.mips.elf File opened for reading /proc/3/stat data.mips.elf File opened for reading /proc/36/fd data.mips.elf File opened for reading /proc/378/fd data.mips.elf File opened for reading /proc/8/comm data.mips.elf File opened for reading /proc/699/comm data.mips.elf File opened for reading /proc/9/comm data.mips.elf File opened for reading /proc/75/comm data.mips.elf File opened for reading /proc/235/cmdline data.mips.elf File opened for reading /proc/665/comm data.mips.elf File opened for reading /proc/729/fd data.mips.elf File opened for reading /proc/6/stat data.mips.elf File opened for reading /proc/361/comm data.mips.elf File opened for reading /proc/120/fd data.mips.elf File opened for reading /proc/235/fd data.mips.elf File opened for reading /proc/5/cmdline data.mips.elf File opened for reading /proc/19/cmdline data.mips.elf File opened for reading /proc/75/stat data.mips.elf File opened for reading /proc/75/fd data.mips.elf File opened for reading /proc/657/fd data.mips.elf File opened for reading /proc/673/fd data.mips.elf File opened for reading /proc/708/fd data.mips.elf File opened for reading /proc/18/fd data.mips.elf File opened for reading /proc/16/comm data.mips.elf File opened for reading /proc/667/cmdline data.mips.elf File opened for reading /proc/667/comm data.mips.elf File opened for reading /proc/673/comm data.mips.elf File opened for reading /proc/77/stat data.mips.elf File opened for reading /proc/155/comm data.mips.elf File opened for reading /proc/109/fd data.mips.elf File opened for reading /proc/382/fd data.mips.elf File opened for reading /proc/770/fd data.mips.elf File opened for reading /proc/73/cmdline data.mips.elf File opened for reading /proc/73/comm data.mips.elf File opened for reading /proc/722/cmdline data.mips.elf File opened for reading /proc/5/comm data.mips.elf File opened for reading /proc/235/comm data.mips.elf File opened for reading /proc/246/cmdline data.mips.elf File opened for reading /proc/723/comm data.mips.elf File opened for reading /proc/73/fd data.mips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 710 data.mips.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.d_lock data.mips.elf