Analysis
- max time kernel
150s - max time network
150s - platform
debian-9_mips - resource
debian9-mipsbe-20260127-en - resource tags
arch:mipsimage:debian9-mipsbe-20260127-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
15/04/2026, 04:06
Static task
static1
Behavioral task
behavioral1
Sample
.Sassy.mips.elf
Resource
debian9-mipsbe-20260127-en
debian-9-mips
5 signatures
150 seconds
General
- Target .Sassy.mips.elf
- Size 153KB
- Sample260415-epldbaet7r
- SHA256 d7f5d644f1ec37156bfcbc04491ec09eb895a190f8253b3fcf98edf16edff6c5
- MD5 34dbfeb0b6a8d0ba430644d4b5da63e1
- SHA1 e62d6d5478994931718de5807e1d85e098079d9f
- SHA512 85a6b3583a26a465b8f29083aa71bc7a3a489f02b7847406b8ff94a22d25cc12b5e44a93e15b3d379aed3898917f74c11f202c9b7e73bbe635d6a0bbd3a4a6a0
- SSDEEP 1536:fFff+Q5rzEwvJ2sjaj9ffNlOyOGLVew355cgNFQuYTNDg3+RxdoWflS:fFvEY2sjaj9fFlOyOGLL5c6SgORxdblS
- TLSH T135E3881A6E328FAEF67C833147B74A24A75D23D623E1D684D2ADC1145F2028E545FFAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 718 .Sassy.mips.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/flylegit 718 .Sassy.mips.elf -
description ioc Process File opened for reading /proc/74/comm .Sassy.mips.elf File opened for reading /proc/77/comm .Sassy.mips.elf File opened for reading /proc/422/comm .Sassy.mips.elf File opened for reading /proc/714/comm .Sassy.mips.elf File opened for reading /proc/5/comm .Sassy.mips.elf File opened for reading /proc/127/comm .Sassy.mips.elf File opened for reading /proc/336/comm .Sassy.mips.elf File opened for reading /proc/9/comm .Sassy.mips.elf File opened for reading /proc/11/comm .Sassy.mips.elf File opened for reading /proc/36/comm .Sassy.mips.elf File opened for reading /proc/2/comm .Sassy.mips.elf File opened for reading /proc/16/comm .Sassy.mips.elf File opened for reading /proc/18/comm .Sassy.mips.elf File opened for reading /proc/152/comm .Sassy.mips.elf File opened for reading /proc/662/comm .Sassy.mips.elf File opened for reading /proc/1/comm .Sassy.mips.elf File opened for reading /proc/4/comm .Sassy.mips.elf File opened for reading /proc/12/comm .Sassy.mips.elf File opened for reading /proc/24/comm .Sassy.mips.elf File opened for reading /proc/82/comm .Sassy.mips.elf File opened for reading /proc/367/comm .Sassy.mips.elf File opened for reading /proc/678/comm .Sassy.mips.elf File opened for reading /proc/13/comm .Sassy.mips.elf File opened for reading /proc/14/comm .Sassy.mips.elf File opened for reading /proc/340/comm .Sassy.mips.elf File opened for reading /proc/390/comm .Sassy.mips.elf File opened for reading /proc/681/comm .Sassy.mips.elf File opened for reading /proc/688/comm .Sassy.mips.elf File opened for reading /proc/711/comm .Sassy.mips.elf File opened for reading /proc/715/comm .Sassy.mips.elf File opened for reading /proc/3/comm .Sassy.mips.elf File opened for reading /proc/705/comm .Sassy.mips.elf File opened for reading /proc/126/comm .Sassy.mips.elf File opened for reading /proc/366/comm .Sassy.mips.elf File opened for reading /proc/368/comm .Sassy.mips.elf File opened for reading /proc/69/comm .Sassy.mips.elf File opened for reading /proc/22/comm .Sassy.mips.elf File opened for reading /proc/72/comm .Sassy.mips.elf File opened for reading /proc/37/comm .Sassy.mips.elf File opened for reading /proc/79/comm .Sassy.mips.elf File opened for reading /proc/339/comm .Sassy.mips.elf File opened for reading /proc/15/comm .Sassy.mips.elf File opened for reading /proc/23/comm .Sassy.mips.elf File opened for reading /proc/73/comm .Sassy.mips.elf File opened for reading /proc/76/comm .Sassy.mips.elf File opened for reading /proc/716/comm .Sassy.mips.elf File opened for reading /proc/6/comm .Sassy.mips.elf File opened for reading /proc/10/comm .Sassy.mips.elf File opened for reading /proc/21/comm .Sassy.mips.elf File opened for reading /proc/110/comm .Sassy.mips.elf File opened for reading /proc/174/comm .Sassy.mips.elf File opened for reading /proc/713/comm .Sassy.mips.elf File opened for reading /proc/19/comm .Sassy.mips.elf File opened for reading /proc/75/comm .Sassy.mips.elf File opened for reading /proc/158/comm .Sassy.mips.elf File opened for reading /proc/704/comm .Sassy.mips.elf File opened for reading /proc/71/comm .Sassy.mips.elf File opened for reading /proc/81/comm .Sassy.mips.elf File opened for reading /proc/384/comm .Sassy.mips.elf File opened for reading /proc/687/comm .Sassy.mips.elf File opened for reading /proc/177/comm .Sassy.mips.elf File opened for reading /proc/253/comm .Sassy.mips.elf File opened for reading /proc/380/comm .Sassy.mips.elf File opened for reading /proc/7/comm .Sassy.mips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 716 .Sassy.mips.elf