Analysis
- max time kernel
147s - max time network
141s - platform
debian-9_mips - resource
debian9-mipsbe-20260127-en - resource tags
arch:mipsimage:debian9-mipsbe-20260127-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
03/05/2026, 11:59
General
- Target manji.mips.elf
- Size 115KB
- Sample260503-n5qgmsgw8x
- SHA256 c632463211c9b0593b1ea64ed8b1733854069c907163af9cd5c7db6e2c010847
- MD5 751e3ed672d9b58dc612e9798f3e5650
- SHA1 685d3f299da76539ab057fa98d58614cd1de3656
- SHA512 e43e8b0e9a480601c2b434d3b1e5d37f73bf5d19a1fe174ee49c62a55fd724348e9a2bc621e4959e39012b0fd9cae771541ce623b8ecda8e0ae3e0ec596b3046
- SSDEEP 1536:tw4lPfv7d7Y/YLpdYo1fpNeHvztsi8ZPDoM1ISWlKnKevNeThmF:7lPfDdMKdYo3wHvzt2ZPDoMCsnShmF
- TLSH T1D2C3B91E6E21CFBEF65A827407F78E31965877D62AE1C585E16CEA400F502CD241FBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Traces itself 17 IoCs
Traces itself to prevent debugging attempts
pid Process 705 manji.mips.elf 705 manji.mips.elf 705 manji.mips.elf 705 manji.mips.elf 705 manji.mips.elf 705 manji.mips.elf 705 manji.mips.elf 705 manji.mips.elf 705 manji.mips.elf 705 manji.mips.elf 705 manji.mips.elf 705 manji.mips.elf 705 manji.mips.elf 705 manji.mips.elf 705 manji.mips.elf 705 manji.mips.elf 705 manji.mips.elf - Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself uhttpd 705 manji.mips.elf Changes the process name, possibly in an attempt to hide itself nginx 705 manji.mips.elf - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo manji.mips.elf -
description ioc Process File opened for reading /proc/mounts manji.mips.elf File opened for reading /proc/self/status manji.mips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 704 manji.mips.elf