Analysis
- max time kernel
148s - max time network
131s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
18/05/2026, 00:13
Static task
static1
Behavioral task
behavioral1
Sample
mipsel
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
5 signatures
150 seconds
General
- Target mipsel
- Size 693KB
- Sample260518-ahs3csd12x
- SHA256 70a7794ad3ab1211a7ffc14d9d6d7b0a9b641bcd2d132144499272b9d9319328
- MD5 2f65a4895ce114b900603ebe6de9a2ba
- SHA1 372575f960c7633d8cfae79854a5c6fbfb52cddd
- SHA512 7132bbea5650e2233a6ea0c5022c1ba57dc2e825580f339fb942f2320e0bfb28f4994a4baeb8bf8348f80a38ca99fa318aa30c4150d48a3be0739d35d0739c67
- SSDEEP 12288:Ovyz8IK3U3TnQBim4TzaZGKwKhWe8lvg9EhR77ywy7cH7iPucozOZNpEHgfoE3FU:PXk7rcoRGFCmy/c/nbVN
- TLSH T133E45B06EF840FEBC4AFCD30492E875B15ED8D9706C1AA3961BC8D9CBA5D2594BD344C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself db 806 mipsel -
description ioc Process File opened for reading /proc/21/comm mipsel File opened for reading /proc/767/comm mipsel File opened for reading /proc/780/comm mipsel File opened for reading /proc/792/comm mipsel File opened for reading /proc/3/comm mipsel File opened for reading /proc/59/comm mipsel File opened for reading /proc/342/comm mipsel File opened for reading /proc/816/comm mipsel File opened for reading /proc/136/comm mipsel File opened for reading /proc/181/comm mipsel File opened for reading /proc/664/comm mipsel File opened for reading /proc/2/comm mipsel File opened for reading /proc/15/comm mipsel File opened for reading /proc/16/comm mipsel File opened for reading /proc/19/comm mipsel File opened for reading /proc/661/comm mipsel File opened for reading /proc/30/comm mipsel File opened for reading /proc/58/comm mipsel File opened for reading /proc/115/comm mipsel File opened for reading /proc/793/comm mipsel File opened for reading /proc/13/comm mipsel File opened for reading /proc/18/comm mipsel File opened for reading /proc/31/comm mipsel File opened for reading /proc/34/comm mipsel File opened for reading /proc/35/comm mipsel File opened for reading /proc/48/comm mipsel File opened for reading /proc/137/comm mipsel File opened for reading /proc/703/comm mipsel File opened for reading /proc/1/comm mipsel File opened for reading /proc/25/comm mipsel File opened for reading /proc/26/comm mipsel File opened for reading /proc/27/comm mipsel File opened for reading /proc/362/comm mipsel File opened for reading /proc/764/comm mipsel File opened for reading /proc/832/comm mipsel File opened for reading /proc/834/comm mipsel File opened for reading /proc/5/comm mipsel File opened for reading /proc/28/comm mipsel File opened for reading /proc/29/comm mipsel File opened for reading /proc/113/comm mipsel File opened for reading /proc/252/comm mipsel File opened for reading /proc/22/comm mipsel File opened for reading /proc/677/comm mipsel File opened for reading /proc/10/comm mipsel File opened for reading /proc/20/comm mipsel File opened for reading /proc/23/comm mipsel File opened for reading /proc/697/comm mipsel File opened for reading /proc/806/comm mipsel File opened for reading /proc/833/comm mipsel File opened for reading /proc/14/comm mipsel File opened for reading /proc/24/comm mipsel File opened for reading /proc/372/comm mipsel File opened for reading /proc/6/comm mipsel File opened for reading /proc/7/comm mipsel File opened for reading /proc/112/comm mipsel File opened for reading /proc/337/comm mipsel File opened for reading /proc/33/comm mipsel File opened for reading /proc/42/comm mipsel File opened for reading /proc/45/comm mipsel File opened for reading /proc/117/comm mipsel File opened for reading /proc/412/comm mipsel File opened for reading /proc/678/comm mipsel File opened for reading /proc/self/status mipsel File opened for reading /proc/346/comm mipsel - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 804 mipsel - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.bot_lock mipsel