2fb3be445b23b3276f06743d46686d9d1493955c4628169ece18e9a68f9a48b2

Analysis

max time kernel
23s
max time network
155s
platform
debian-12_mipsel
resource
debian12-mipsel-20260513-en
resource tags

arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
16/05/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
64.89.163.196_sample.bin
Size 83KB
Sample260516-vbksmaaz7m
SHA256 2fb3be445b23b3276f06743d46686d9d1493955c4628169ece18e9a68f9a48b2
MD5 e5e7f520ff9159c719a87922bbce0b80
SHA1 98e9e28b04cfb0dd4a5a6d4108a59d094428ca03
SHA512 e5e35945b2cdae88d040173049eb4f8815989af1f902025a472c209320e4a806cb143f54df1965bcb7777125e64202fd9f5aff52396f41f9f3b3a0d8b672db98
SSDEEP 1536:3N2GyVP3r62B13x7KvE6NQ4tJkUthqbB9+Ahx1bQ3OYavnUGAWGj:3NzyVP3r6ydxUaUthcBVpbQ3ODs8W
TLSH
T1E38302607E61B60FCBF99E302842F51DF99F64C12BC74D987E0505B1A77A4DF8922A70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (4141) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/containerq	cp

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	[kworker/u4:2]	802	64.89.163.196_sample.bin

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/exe	64.89.163.196_sample.bin
File opened for reading	/proc/filesystems	cp

/tmp/64.89.163.196_sample.bin
/tmp/64.89.163.196_sample.bin
1⤵
- Changes its process name
- Reads runtime system information
PID:799
- /bin/sh
  sh -c "cp -f /tmp/64.89.163.196_sample.bin /usr/local/bin/containerq 2>/dev/null"
  2⤵
  PID:803
- - /usr/bin/cp
    cp -f /tmp/64.89.163.196_sample.bin /usr/local/bin/containerq
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:806
- /bin/sh
  sh -c "cp -f /tmp/64.89.163.196_sample.bin /var/tmp/.containerq 2>/dev/null"
  2⤵
  PID:808
- - /usr/bin/cp
    cp -f /tmp/64.89.163.196_sample.bin /var/tmp/.containerq
    3⤵
    - Reads runtime system information
    PID:811

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads