Analysis
- max time kernel
34s - max time network
39s - platform
debian-9_mips - resource
debian9-mipsbe-20260126-en - resource tags
arch:mipsimage:debian9-mipsbe-20260126-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
24/04/2026, 01:46
Static task
static1
Behavioral task
behavioral1
Sample
63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf
Resource
debian9-mipsbe-20260126-en
debian-9-mips
3 signatures
40 seconds
General
- Target 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf
- Size 165KB
- Sample260424-b7c8wabs7j
- SHA256 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a
- MD5 ad9e3d0923e4921949a382ee120fa95f
- SHA1 3b6890741ac6b0aed2077713aa35329b772edace
- SHA512 d39cb91da9a493632ec07257a5e23934f7c87bcb8ae84c7581ba7c9d36ee90d90fc730e1aa3b479537d576cf8687b4b5394dcfc7595121ba429321e7c942928e
- SSDEEP 1536:VXK95pZAla7e1fHPOix3E4+0hIxQgAai67kUJSMqXGLeXv3/lwqgTPnKWWO306xB:VXKrJ7vAaiMkySPXG0v37oRW36xALls
- TLSH T148F3885E6E238F7EF668873047F74E25976823D623E1D684E1ACC1145F2029E641FFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 724 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf -
description ioc Process File opened for reading /proc/74/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/751/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/757/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/788/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/793/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/734/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/774/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/777/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/70/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/753/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/755/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/765/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/775/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/778/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/266/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/671/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/725/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/738/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/787/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/12/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/746/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/761/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/763/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/780/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/789/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/36/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/714/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/722/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/741/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/795/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/747/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/748/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/764/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/77/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/347/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/783/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/16/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/17/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/23/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/72/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/79/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/76/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/693/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/721/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/733/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/779/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/10/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/377/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/727/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/770/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/794/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/110/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/389/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/742/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/772/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/785/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/21/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/82/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/759/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/769/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/782/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/24/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/9/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf File opened for reading /proc/390/cmdline 63514f949cf6b4839db72f7c0756e177ad8274851cf6735330738514dc5e179a.elf