Analysis
- max time kernel
26s - max time network
149s - platform
debian-9_mips - resource
debian9-mipsbe-20260126-en - resource tags
arch:mipsimage:debian9-mipsbe-20260126-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
20/04/2026, 18:34
Behavioral task
behavioral1
Sample
00okmips.elf
Resource
debian9-mipsbe-20260126-en
debian-9-mips
7 signatures
150 seconds
General
- Target 00okmips.elf
- Size 55KB
- Sample260420-w735hset31
- SHA256 2e0f705a3ce36fc2faf33287957ce294ca9a2b5439094ebc0fc91c72c43a2358
- MD5 9962570a8cafbe61713e291257ecb31b
- SHA1 8d9adf77dc68b982fedc011392872626cc579925
- SHA512 8400855baf204a1377b40e8ae79d9fb185088a116a48031845c3bbd415f526f26e36db0db7c3009b7d26a4be4a6f7268d7ae3d6896b57497909252b47d281e04
- SSDEEP 768:RaT+l5PNxAGJYmzrEIPfEIXwKE5jNxAjACOFym6OCLdc34pAOreBAWslnk/zw2:Rn5FxAGJtzh6H5jN2ZLdc3EzCw2
- TLSH T17543971E2E619FFCFBAD863587F39E219648339216E1C684E15CDA011E7034E745FBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 00okmips.elf File opened for modification /dev/misc/watchdog 00okmips.elf - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 00okmips.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself bhbasbbshshshhsshb 725 00okmips.elf - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 00okmips.elf -
description ioc Process File opened for reading /proc/697/exe 00okmips.elf File opened for reading /proc/722/exe 00okmips.elf File opened for reading /proc/789/exe 00okmips.elf File opened for reading /proc/345/fd 00okmips.elf File opened for reading /proc/399/fd 00okmips.elf File opened for reading /proc/697/fd 00okmips.elf File opened for reading /proc/785/exe 00okmips.elf File opened for reading /proc/728/fd 00okmips.elf File opened for reading /proc/729/fd 00okmips.elf File opened for reading /proc/726/exe 00okmips.elf File opened for reading /proc/350/fd 00okmips.elf File opened for reading /proc/379/fd 00okmips.elf File opened for reading /proc/736/exe 00okmips.elf File opened for reading /proc/698/fd 00okmips.elf File opened for reading /proc/797/exe 00okmips.elf File opened for reading /proc/1/fd 00okmips.elf File opened for reading /proc/685/fd 00okmips.elf File opened for reading /proc/687/fd 00okmips.elf File opened for reading /proc/714/exe 00okmips.elf File opened for reading /proc/729/exe 00okmips.elf File opened for reading /proc/154/fd 00okmips.elf File opened for reading /proc/264/fd 00okmips.elf File opened for reading /proc/346/fd 00okmips.elf File opened for reading /proc/378/fd 00okmips.elf File opened for reading /proc/720/exe 00okmips.elf File opened for reading /proc/452/exe 00okmips.elf File opened for reading /proc/176/fd 00okmips.elf File opened for reading /proc/393/fd 00okmips.elf File opened for reading /proc/452/fd 00okmips.elf File opened for reading /proc/672/exe 00okmips.elf File opened for reading /proc/687/exe 00okmips.elf File opened for reading /proc/721/exe 00okmips.elf File opened for reading /proc/394/fd 00okmips.elf File opened for reading /proc/672/fd 00okmips.elf File opened for reading /proc/715/fd 00okmips.elf File opened for reading /proc/698/exe 00okmips.elf File opened for reading /proc/731/exe 00okmips.elf File opened for reading /proc/714/fd 00okmips.elf File opened for reading /proc/726/fd 00okmips.elf File opened for reading /proc/685/exe 00okmips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 725 00okmips.elf