Analysis
- max time kernel
143s - max time network
145s - platform
debian-9_mips - resource
debian9-mipsbe-20260126-en - resource tags
arch:mipsimage:debian9-mipsbe-20260126-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
22/04/2026, 00:21
Behavioral task
behavioral1
Sample
Space.mips
Resource
debian9-mipsbe-20260126-en
debian-9-mips
6 signatures
150 seconds
General
- Target Space.mips
- Size 37KB
- Sample260422-ancybsh16s
- SHA256 a6e64017a27686771e2f8115fce3f6461fc9eb13ee1da0d50cbc3adf14fc2b00
- MD5 e4b6ef94cd3ed3b02bd81cae2ce30599
- SHA1 ec13faa8a500f1cd473d3fca698a86bdd7f38510
- SHA512 ec7597a03a84a3870f1b54a927e7217920e55b788e38617ecd02e4ffa59f6b02713ba409f0ca7d8d694a6c4c95bacac2393fb21d715f3605fb5f041e27860fa5
- SSDEEP 768:7dJAvi5nYhR/xjbJ6SJjpBGsHibnfdVdO0UBza++JgGlzDpbuR1Jf:7daihY3flInfHo0qiVJuh
- TLSH T1DE03F1381E2410CCC568C9B5AA558BFA3A466FA360429A333D47BAD37A5F23130DB5E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Space.mips File opened for modification /dev/misc/watchdog Space.mips - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Space.mips File opened for modification /bin/watchdog Space.mips -
description ioc Process File opened for reading /proc/330/status Space.mips File opened for reading /proc/376/status Space.mips File opened for reading /proc/6/status Space.mips File opened for reading /proc/113/status Space.mips File opened for reading /proc/331/status Space.mips File opened for reading /proc/360/status Space.mips File opened for reading /proc/674/status Space.mips File opened for reading /proc/73/status Space.mips File opened for reading /proc/148/status Space.mips File opened for reading /proc/324/status Space.mips File opened for reading /proc/656/status Space.mips File opened for reading /proc/9/status Space.mips File opened for reading /proc/24/status Space.mips File opened for reading /proc/36/status Space.mips File opened for reading /proc/227/status Space.mips File opened for reading /proc/325/status Space.mips File opened for reading /proc/678/status Space.mips File opened for reading /proc/21/status Space.mips File opened for reading /proc/4/status Space.mips File opened for reading /proc/378/status Space.mips File opened for reading /proc/1/status Space.mips File opened for reading /proc/8/status Space.mips File opened for reading /proc/17/status Space.mips File opened for reading /proc/23/status Space.mips File opened for reading /proc/37/status Space.mips File opened for reading /proc/74/status Space.mips File opened for reading /proc/329/status Space.mips File opened for reading /proc/70/status Space.mips File opened for reading /proc/7/status Space.mips File opened for reading /proc/10/status Space.mips File opened for reading /proc/12/status Space.mips File opened for reading /proc/243/status Space.mips File opened for reading /proc/706/status Space.mips File opened for reading /proc/75/status Space.mips File opened for reading /proc/76/status Space.mips File opened for reading /proc/77/status Space.mips File opened for reading /proc/79/status Space.mips File opened for reading /proc/709/status Space.mips File opened for reading /proc/713/status Space.mips File opened for reading /proc/5/status Space.mips File opened for reading /proc/22/status Space.mips File opened for reading /proc/669/status Space.mips File opened for reading /proc/699/status Space.mips File opened for reading /proc/71/status Space.mips File opened for reading /proc/2/status Space.mips File opened for reading /proc/423/status Space.mips File opened for reading /proc/704/status Space.mips File opened for reading /proc/707/status Space.mips File opened for reading /proc/19/status Space.mips File opened for reading /proc/72/status Space.mips File opened for reading /proc/104/status Space.mips File opened for reading /proc/114/status Space.mips File opened for reading /proc/698/status Space.mips File opened for reading /proc/11/status Space.mips File opened for reading /proc/18/status Space.mips File opened for reading /proc/142/status Space.mips File opened for reading /proc/163/status Space.mips File opened for reading /proc/380/status Space.mips File opened for reading /proc/3/status Space.mips File opened for reading /proc/16/status Space.mips File opened for reading /proc/78/status Space.mips File opened for reading /proc/82/status Space.mips File opened for reading /proc/714/status Space.mips File opened for reading /proc/20/status Space.mips - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 709 Space.mips