Analysis
- max time kernel
150s - max time network
141s - platform
debian-9_mips - resource
debian9-mipsbe-20260126-en - resource tags
arch:mipsimage:debian9-mipsbe-20260126-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
16/04/2026, 16:47
Behavioral task
behavioral1
Sample
mips.elf
Resource
debian9-mipsbe-20260126-en
debian-9-mips
11 signatures
150 seconds
General
- Target mips.elf
- Size 98KB
- Sample260416-varjsaav6v
- SHA256 bc8297cf7a88c6b679df9c69cbb2aaa2302e19b3622e0cde040a085025760699
- MD5 6fadca3d08c9107da17a60da7b82bdbc
- SHA1 7fa3dfa1c74a191651de1987c2a5bdb19b25ef30
- SHA512 9fc9ea73fc4ab943d46ad7e031cdd5ea99778bb13ed956f76f7bc94ecf46c97528aa39da05d5247d86708a56a2f28c6cfd684fd168058b0e8f0fe77667bcf7d5
- SSDEEP 1536:PJSzm+oHkSS/plQ+631BTBM6d9k9bL0+uXIp+rI+Lpl8XAzAe31aLqcsSjDO:PUzm+Ak4ksbrXL8QMNsSjS
- TLSH T134A3A80A3F21CF6EF669937047F74E21974837D626E1D681E15CEA411E603CE681FBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog mips.elf File opened for modification /dev/misc/watchdog mips.elf - OS Credential Dumping 1 TTPs 1 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
description ioc Process File opened for reading /etc/shadow su - Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 718 mips.elf - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp mips.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 30 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/260/maps mips.elf File opened for reading /proc/675/maps mips.elf File opened for reading /proc/715/maps mips.elf File opened for reading /proc/736/maps mips.elf File opened for reading /proc/761/maps mips.elf File opened for reading /proc/345/maps mips.elf File opened for reading /proc/663/maps mips.elf File opened for reading /proc/341/maps mips.elf File opened for reading /proc/370/maps mips.elf File opened for reading /proc/704/maps mips.elf File opened for reading /proc/705/maps mips.elf File opened for reading /proc/762/maps mips.elf File opened for reading /proc/367/maps mips.elf File opened for reading /proc/383/maps mips.elf File opened for reading /proc/746/maps mips.elf File opened for reading /proc/790/maps mips.elf File opened for reading /proc/176/maps mips.elf File opened for reading /proc/770/maps mips.elf File opened for reading /proc/384/maps mips.elf File opened for reading /proc/390/maps mips.elf File opened for reading /proc/678/maps mips.elf File opened for reading /proc/722/maps mips.elf File opened for reading /proc/782/maps mips.elf File opened for reading /proc/420/maps mips.elf File opened for reading /proc/750/maps mips.elf File opened for reading /proc/156/maps mips.elf File opened for reading /proc/366/maps mips.elf File opened for reading /proc/680/maps mips.elf File opened for reading /proc/681/maps mips.elf File opened for reading /proc/754/maps mips.elf - Changes its process name 4 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself [kworker/u:1] 716 mips.elf Changes the process name, possibly in an attempt to hide itself [kworker/u:1] 739 mips.elf Changes the process name, possibly in an attempt to hide itself [kworker/u:1] 738 mips.elf Changes the process name, possibly in an attempt to hide itself [kworker/u:1] 740 mips.elf - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp mips.elf - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus su -
description ioc Process File opened for reading /proc/370/cmdline mips.elf File opened for reading /proc/663/status mips.elf File opened for reading /proc/663/fd mips.elf File opened for reading /proc/754/fd mips.elf File opened for reading /proc/260/stat mips.elf File opened for reading /proc/384/status mips.elf File opened for reading /proc/663/cmdline mips.elf File opened for reading /proc/678/stat mips.elf File opened for reading /proc/681/cmdline mips.elf File opened for reading /proc/736/cmdline mips.elf File opened for reading /proc/746/cmdline mips.elf File opened for reading /proc/1/limits su File opened for reading /proc/782/fd mips.elf File opened for reading /proc/156/status mips.elf File opened for reading /proc/156/stat mips.elf File opened for reading /proc/383/stat mips.elf File opened for reading /proc/715/stat mips.elf File opened for reading /proc/722/fd mips.elf File opened for reading /proc/770/cmdline mips.elf File opened for reading /proc/filesystems su File opened for reading /proc/675/fd mips.elf File opened for reading /proc/770/stat mips.elf File opened for reading /proc/366/cmdline mips.elf File opened for reading /proc/367/status mips.elf File opened for reading /proc/176/stat mips.elf File opened for reading /proc/366/stat mips.elf File opened for reading /proc/680/fd mips.elf File opened for reading /proc/790/status mips.elf File opened for reading /proc/345/cmdline mips.elf File opened for reading /proc/383/status mips.elf File opened for reading /proc/782/cmdline mips.elf File opened for reading /proc/260/cmdline mips.elf File opened for reading /proc/367/fd mips.elf File opened for reading /proc/370/stat mips.elf File opened for reading /proc/390/fd mips.elf File opened for reading /proc/420/fd mips.elf File opened for reading /proc/704/fd mips.elf File opened for reading /proc/705/fd mips.elf File opened for reading /proc/746/stat mips.elf File opened for reading /proc/680/stat mips.elf File opened for reading /proc/715/fd mips.elf File opened for reading /proc/156/fd mips.elf File opened for reading /proc/176/status mips.elf File opened for reading /proc/366/fd mips.elf File opened for reading /proc/390/stat mips.elf File opened for reading /proc/176/cmdline mips.elf File opened for reading /proc/260/status mips.elf File opened for reading /proc/341/cmdline mips.elf File opened for reading /proc/384/cmdline mips.elf File opened for reading /proc/705/cmdline mips.elf File opened for reading /proc/420/cmdline mips.elf File opened for reading /proc/680/cmdline mips.elf File opened for reading /proc/681/fd mips.elf File opened for reading /proc/384/fd mips.elf File opened for reading /proc/746/fd mips.elf File opened for reading /proc/sys/kernel/ngroups_max su File opened for reading /proc/self/status mips.elf File opened for reading /proc/722/stat mips.elf File opened for reading /proc/761/cmdline mips.elf File opened for reading /proc/762/stat mips.elf File opened for reading /proc/762/fd mips.elf File opened for reading /proc/782/status mips.elf File opened for reading /proc/260/fd mips.elf File opened for reading /proc/722/status mips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 716 mips.elf
Processes
-
/tmp/mips.elf/tmp/mips.elf1⤵
- Modifies Watchdog functionality
- Traces itself
- Enumerates active TCP sockets
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information
- System Network Configuration Discovery
PID:716 -
/bin/shsh -c "su -c id > /dev/null 2>&1"2⤵PID:719
-
/bin/susu -c id3⤵
- OS Credential Dumping
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:721 -
/bin/bashbash -c id4⤵PID:732
-
-
/usr/bin/idid4⤵PID:732
-
-
-