Analysis
- max time kernel
135s - max time network
148s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
19/05/2026, 19:41
Behavioral task
behavioral1
Sample
Space.mips.elf
Resource
debian9-mipsbe-20260513-en
debian-9-mips
5 signatures
150 seconds
General
- Target Space.mips.elf
- Size 98KB
- Sample260519-yd85saev2r
- SHA256 1de11b6939b5f08735782448b7ea981c5d361847edce9fedc684aaeddf3eee24
- MD5 6b088422e76c68f1799c19c87b7a55e5
- SHA1 a6ed29361a8338daf193c24ffcbe435ebf835b3a
- SHA512 b12c394ea6bf7e6f36d44654d99745a87ac91bcc62a0bc8f67dbf26180473cdf74545078a79646272a18ef9a6fc18d2c29081fbb6446963cf062b519883cfd9c
- SSDEEP 1536:SpaZOuj/Q30SQXa1r3J62yqPy/RWLW0edmpwj65NYK:5ZzjJa1rZ62yqPy/ULWzj65N9
- TLSH T1B6A3B44D7E318FBEFBEC823447B39A12A65927D533E1C585D2ADD2011E7024E681FBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Space.mips.elf File opened for modification /dev/misc/watchdog Space.mips.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Space.mips.elf File opened for modification /bin/watchdog Space.mips.elf -
description ioc Process File opened for reading /proc/22/status Space.mips.elf File opened for reading /proc/110/status Space.mips.elf File opened for reading /proc/208/status Space.mips.elf File opened for reading /proc/700/status Space.mips.elf File opened for reading /proc/10/status Space.mips.elf File opened for reading /proc/155/status Space.mips.elf File opened for reading /proc/14/status Space.mips.elf File opened for reading /proc/15/status Space.mips.elf File opened for reading /proc/16/status Space.mips.elf File opened for reading /proc/9/status Space.mips.elf File opened for reading /proc/125/status Space.mips.elf File opened for reading /proc/126/status Space.mips.elf File opened for reading /proc/305/status Space.mips.elf File opened for reading /proc/692/status Space.mips.elf File opened for reading /proc/21/status Space.mips.elf File opened for reading /proc/657/status Space.mips.elf File opened for reading /proc/666/status Space.mips.elf File opened for reading /proc/697/status Space.mips.elf File opened for reading /proc/702/status Space.mips.elf File opened for reading /proc/13/status Space.mips.elf File opened for reading /proc/2/status Space.mips.elf File opened for reading /proc/223/status Space.mips.elf File opened for reading /proc/8/status Space.mips.elf File opened for reading /proc/18/status Space.mips.elf File opened for reading /proc/349/status Space.mips.elf File opened for reading /proc/659/status Space.mips.elf File opened for reading /proc/12/status Space.mips.elf File opened for reading /proc/1/status Space.mips.elf File opened for reading /proc/11/status Space.mips.elf File opened for reading /proc/24/status Space.mips.elf File opened for reading /proc/72/status Space.mips.elf File opened for reading /proc/79/status Space.mips.elf File opened for reading /proc/357/status Space.mips.elf File opened for reading /proc/6/status Space.mips.elf File opened for reading /proc/160/status Space.mips.elf File opened for reading /proc/3/status Space.mips.elf File opened for reading /proc/75/status Space.mips.elf File opened for reading /proc/77/status Space.mips.elf File opened for reading /proc/17/status Space.mips.elf File opened for reading /proc/36/status Space.mips.elf File opened for reading /proc/705/status Space.mips.elf File opened for reading /proc/5/status Space.mips.elf File opened for reading /proc/7/status Space.mips.elf File opened for reading /proc/23/status Space.mips.elf File opened for reading /proc/76/status Space.mips.elf File opened for reading /proc/173/status Space.mips.elf File opened for reading /proc/308/status Space.mips.elf File opened for reading /proc/665/status Space.mips.elf File opened for reading /proc/20/status Space.mips.elf File opened for reading /proc/37/status Space.mips.elf File opened for reading /proc/71/status Space.mips.elf File opened for reading /proc/74/status Space.mips.elf File opened for reading /proc/312/status Space.mips.elf File opened for reading /proc/701/status Space.mips.elf File opened for reading /proc/70/status Space.mips.elf File opened for reading /proc/83/status Space.mips.elf File opened for reading /proc/310/status Space.mips.elf File opened for reading /proc/365/status Space.mips.elf File opened for reading /proc/19/status Space.mips.elf File opened for reading /proc/73/status Space.mips.elf File opened for reading /proc/81/status Space.mips.elf File opened for reading /proc/307/status Space.mips.elf File opened for reading /proc/351/status Space.mips.elf File opened for reading /proc/693/status Space.mips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 701 Space.mips.elf