Analysis
- max time kernel
147s - max time network
151s - platform
debian-9_mips - resource
debian9-mipsbe-20260126-en - resource tags
arch:mipsimage:debian9-mipsbe-20260126-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
11/05/2026, 15:51
Static task
static1
Behavioral task
behavioral1
Sample
176.65.139.79_sample.bin
Resource
debian9-mipsbe-20260126-en
debian-9-mips
6 signatures
150 seconds
General
- Target 176.65.139.79_sample.bin
- Size 91KB
- Sample260511-talsvsdx8v
- SHA256 13253c0e308847739354b5f8bbde0da98217c93aeb129eefcc538392cc0968f6
- MD5 c747ebc2d2ed9e84e39e1aca7fefc302
- SHA1 aaa84a2f6e76bd6a3fe8ce6bf88a84d73c85128b
- SHA512 b5d3ca6d2fbb28db8944481a4f20a96a1f1ab7cea4b1ff72833b7b5ffa9c230c121ceb56e4f7aa45a6f9708e4206e89c7a355a4bde1229e8a61ee88d61d698cb
- SSDEEP 1536:CUNwGhFNOy+qPqhUv7Zb7dEMahKwremHy8XaSwW:CUNhFNyOqivVb2MaHTXqW
- TLSH T13D93C91E6E219FBDF769C23047B78A25A35833C637E1D585E25CD6005F6024E642FFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 715 176.65.139.79_sample.bin - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 176.65.139.79_sample.bin File opened for modification /dev/misc/watchdog 176.65.139.79_sample.bin - Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 Destination IP 176.65.139.79 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself pi25getr0fcm 715 176.65.139.79_sample.bin -
description ioc Process File opened for reading /proc/126cmdline 176.65.139.79_sample.bin File opened for reading /proc/346cmdline 176.65.139.79_sample.bin File opened for reading /proc/785cmdline 176.65.139.79_sample.bin File opened for reading /proc/819cmdline 176.65.139.79_sample.bin File opened for reading /proc/684cmdline 176.65.139.79_sample.bin File opened for reading /proc/704cmdline 176.65.139.79_sample.bin File opened for reading /proc/776cmdline 176.65.139.79_sample.bin File opened for reading /proc/806cmdline 176.65.139.79_sample.bin File opened for reading /proc/8cmdline 176.65.139.79_sample.bin File opened for reading /proc/236cmdline 176.65.139.79_sample.bin File opened for reading /proc/711cmdline 176.65.139.79_sample.bin File opened for reading /proc/8/stat 176.65.139.79_sample.bin File opened for reading /proc/13/stat 176.65.139.79_sample.bin File opened for reading /proc/6cmdline 176.65.139.79_sample.bin File opened for reading /proc/783cmdline 176.65.139.79_sample.bin File opened for reading /proc/37cmdline 176.65.139.79_sample.bin File opened for reading /proc/741cmdline 176.65.139.79_sample.bin File opened for reading /proc/742cmdline 176.65.139.79_sample.bin File opened for reading /proc/790cmdline 176.65.139.79_sample.bin File opened for reading /proc/800cmdline 176.65.139.79_sample.bin File opened for reading /proc/14/stat 176.65.139.79_sample.bin File opened for reading /proc/79/stat 176.65.139.79_sample.bin File opened for reading /proc/252cmdline 176.65.139.79_sample.bin File opened for reading /proc/747cmdline 176.65.139.79_sample.bin File opened for reading /proc/75/stat 176.65.139.79_sample.bin File opened for reading /proc/676cmdline 176.65.139.79_sample.bin File opened for reading /proc/19cmdline 176.65.139.79_sample.bin File opened for reading /proc/127/stat 176.65.139.79_sample.bin File opened for reading /proc/722cmdline 176.65.139.79_sample.bin File opened for reading /proc/756cmdline 176.65.139.79_sample.bin File opened for reading /proc/762cmdline 176.65.139.79_sample.bin File opened for reading /proc/766cmdline 176.65.139.79_sample.bin File opened for reading /proc/71/stat 176.65.139.79_sample.bin File opened for reading /proc/721cmdline 176.65.139.79_sample.bin File opened for reading /proc/746cmdline 176.65.139.79_sample.bin File opened for reading /proc/754cmdline 176.65.139.79_sample.bin File opened for reading /proc/859/stat 176.65.139.79_sample.bin File opened for reading /proc/71cmdline 176.65.139.79_sample.bin File opened for reading /proc/76cmdline 176.65.139.79_sample.bin File opened for reading /proc/127cmdline 176.65.139.79_sample.bin File opened for reading /proc/804cmdline 176.65.139.79_sample.bin File opened for reading /proc/76/stat 176.65.139.79_sample.bin File opened for reading /proc/673/stat 176.65.139.79_sample.bin File opened for reading /proc/712/stat 176.65.139.79_sample.bin File opened for reading /proc/860/stat 176.65.139.79_sample.bin File opened for reading /proc/16cmdline 176.65.139.79_sample.bin File opened for reading /proc/673cmdline 176.65.139.79_sample.bin File opened for reading /proc/786cmdline 176.65.139.79_sample.bin File opened for reading /proc/828cmdline 176.65.139.79_sample.bin File opened for reading /proc/37/stat 176.65.139.79_sample.bin File opened for reading /proc/155/stat 176.65.139.79_sample.bin File opened for reading /proc/349/stat 176.65.139.79_sample.bin File opened for reading /proc/2cmdline 176.65.139.79_sample.bin File opened for reading /proc/3cmdline 176.65.139.79_sample.bin File opened for reading /proc/730cmdline 176.65.139.79_sample.bin File opened for reading /proc/778cmdline 176.65.139.79_sample.bin File opened for reading /proc/12/stat 176.65.139.79_sample.bin File opened for reading /proc/18/stat 176.65.139.79_sample.bin File opened for reading /proc/161/stat 176.65.139.79_sample.bin File opened for reading /proc/794cmdline 176.65.139.79_sample.bin File opened for reading /proc/810cmdline 176.65.139.79_sample.bin File opened for reading /proc/77/stat 176.65.139.79_sample.bin File opened for reading /proc/733cmdline 176.65.139.79_sample.bin File opened for reading /proc/737cmdline 176.65.139.79_sample.bin