Analysis
- max time kernel
149s - max time network
147s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
22/05/2026, 00:42
Behavioral task
behavioral1
Sample
bin.mips.elf
Resource
debian9-mipsbe-20260513-en
debian-9-mips
7 signatures
150 seconds
General
- Target bin.mips.elf
- Size 114KB
- Sample260522-a2lsdsd19s
- SHA256 25a21c6cff4e75a9ff8284ca6dddc71b1c3799b726d94b29ed82dbed0df6a0aa
- MD5 a36b3de32590e9bf630bfaaab2acbe55
- SHA1 a04c865d1a60ad65f51fdca754b7a403d5abb8ea
- SHA512 3657964cd762a36b01cd44826c201464f60a7a90b9b9cd8711a5b94f6d81a0f34d02877346981834fa6bc96b45dd1b35bcd95c26f27eb593bb846c4a4886c562
- SSDEEP 1536:ZksWRvitTUjcND+gxEzTSzplebJiK3ZRthUa2oe5CrePQPbnYWPqXL:r4vitG+wzTLh3jthUaFe5CJnY7b
- TLSH T136B3D90B6E218FADF369823547B38F21979923D627E1D685E2ACD5001F6034E645FFE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 724 bin.mips.elf - Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 9.9.9.11 Destination IP 9.9.9.11 Destination IP 9.9.9.11 Destination IP 9.9.9.11 Destination IP 9.9.9.11 - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/789/maps bin.mips.elf File opened for reading /proc/827/maps bin.mips.elf File opened for reading /proc/10/maps bin.mips.elf File opened for reading /proc/12/maps bin.mips.elf File opened for reading /proc/16/maps bin.mips.elf File opened for reading /proc/126/maps bin.mips.elf File opened for reading /proc/9/maps bin.mips.elf File opened for reading /proc/677/maps bin.mips.elf File opened for reading /proc/779/maps bin.mips.elf File opened for reading /proc/11/maps bin.mips.elf File opened for reading /proc/19/maps bin.mips.elf File opened for reading /proc/342/maps bin.mips.elf File opened for reading /proc/690/maps bin.mips.elf File opened for reading /proc/691/maps bin.mips.elf File opened for reading /proc/805/maps bin.mips.elf File opened for reading /proc/810/maps bin.mips.elf File opened for reading /proc/811/maps bin.mips.elf File opened for reading /proc/347/maps bin.mips.elf File opened for reading /proc/17/maps bin.mips.elf File opened for reading /proc/70/maps bin.mips.elf File opened for reading /proc/688/maps bin.mips.elf File opened for reading /proc/722/maps bin.mips.elf File opened for reading /proc/3/maps bin.mips.elf File opened for reading /proc/18/maps bin.mips.elf File opened for reading /proc/69/maps bin.mips.elf File opened for reading /proc/735/maps bin.mips.elf File opened for reading /proc/783/maps bin.mips.elf File opened for reading /proc/820/maps bin.mips.elf File opened for reading /proc/24/maps bin.mips.elf File opened for reading /proc/253/maps bin.mips.elf File opened for reading /proc/715/maps bin.mips.elf File opened for reading /proc/4/maps bin.mips.elf File opened for reading /proc/22/maps bin.mips.elf File opened for reading /proc/79/maps bin.mips.elf File opened for reading /proc/393/maps bin.mips.elf File opened for reading /proc/723/maps bin.mips.elf File opened for reading /proc/782/maps bin.mips.elf File opened for reading /proc/794/maps bin.mips.elf File opened for reading /proc/816/maps bin.mips.elf File opened for reading /proc/2/maps bin.mips.elf File opened for reading /proc/77/maps bin.mips.elf File opened for reading /proc/160/maps bin.mips.elf File opened for reading /proc/177/maps bin.mips.elf File opened for reading /proc/341/maps bin.mips.elf File opened for reading /proc/804/maps bin.mips.elf File opened for reading /proc/821/maps bin.mips.elf File opened for reading /proc/36/maps bin.mips.elf File opened for reading /proc/37/maps bin.mips.elf File opened for reading /proc/82/maps bin.mips.elf File opened for reading /proc/786/maps bin.mips.elf File opened for reading /proc/800/maps bin.mips.elf File opened for reading /proc/23/maps bin.mips.elf File opened for reading /proc/71/maps bin.mips.elf File opened for reading /proc/110/maps bin.mips.elf File opened for reading /proc/447/maps bin.mips.elf File opened for reading /proc/685/maps bin.mips.elf File opened for reading /proc/5/maps bin.mips.elf File opened for reading /proc/7/maps bin.mips.elf File opened for reading /proc/13/maps bin.mips.elf File opened for reading /proc/73/maps bin.mips.elf File opened for reading /proc/157/maps bin.mips.elf File opened for reading /proc/345/maps bin.mips.elf File opened for reading /proc/6/maps bin.mips.elf File opened for reading /proc/14/maps bin.mips.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself gpioc_daemon 724 bin.mips.elf -
description ioc Process File opened for reading /proc/12/comm bin.mips.elf File opened for reading /proc/24/comm bin.mips.elf File opened for reading /proc/253/comm bin.mips.elf File opened for reading /proc/685/comm bin.mips.elf File opened for reading /proc/690/comm bin.mips.elf File opened for reading /proc/15/comm bin.mips.elf File opened for reading /proc/73/comm bin.mips.elf File opened for reading /proc/735/comm bin.mips.elf File opened for reading /proc/816/comm bin.mips.elf File opened for reading /proc/5/comm bin.mips.elf File opened for reading /proc/10/comm bin.mips.elf File opened for reading /proc/339/comm bin.mips.elf File opened for reading /proc/342/comm bin.mips.elf File opened for reading /proc/347/comm bin.mips.elf File opened for reading /proc/677/comm bin.mips.elf File opened for reading /proc/688/comm bin.mips.elf File opened for reading /proc/783/comm bin.mips.elf File opened for reading /proc/23/comm bin.mips.elf File opened for reading /proc/36/comm bin.mips.elf File opened for reading /proc/76/comm bin.mips.elf File opened for reading /proc/157/comm bin.mips.elf File opened for reading /proc/160/comm bin.mips.elf File opened for reading /proc/786/comm bin.mips.elf File opened for reading /proc/794/comm bin.mips.elf File opened for reading /proc/799/comm bin.mips.elf File opened for reading /proc/790/comm bin.mips.elf File opened for reading /proc/827/comm bin.mips.elf File opened for reading /proc/13/comm bin.mips.elf File opened for reading /proc/21/comm bin.mips.elf File opened for reading /proc/126/comm bin.mips.elf File opened for reading /proc/691/comm bin.mips.elf File opened for reading /proc/725/comm bin.mips.elf File opened for reading /proc/779/comm bin.mips.elf File opened for reading /proc/782/comm bin.mips.elf File opened for reading /proc/789/comm bin.mips.elf File opened for reading /proc/3/comm bin.mips.elf File opened for reading /proc/18/comm bin.mips.elf File opened for reading /proc/74/comm bin.mips.elf File opened for reading /proc/800/comm bin.mips.elf File opened for reading /proc/810/comm bin.mips.elf File opened for reading /proc/811/comm bin.mips.elf File opened for reading /proc/2/comm bin.mips.elf File opened for reading /proc/6/comm bin.mips.elf File opened for reading /proc/71/comm bin.mips.elf File opened for reading /proc/79/comm bin.mips.elf File opened for reading /proc/177/comm bin.mips.elf File opened for reading /proc/237/comm bin.mips.elf File opened for reading /proc/804/comm bin.mips.elf File opened for reading /proc/7/comm bin.mips.elf File opened for reading /proc/16/comm bin.mips.elf File opened for reading /proc/20/comm bin.mips.elf File opened for reading /proc/37/comm bin.mips.elf File opened for reading /proc/11/comm bin.mips.elf File opened for reading /proc/14/comm bin.mips.elf File opened for reading /proc/19/comm bin.mips.elf File opened for reading /proc/345/comm bin.mips.elf File opened for reading /proc/393/comm bin.mips.elf File opened for reading /proc/399/comm bin.mips.elf File opened for reading /proc/720/comm bin.mips.elf File opened for reading /proc/82/comm bin.mips.elf File opened for reading /proc/341/comm bin.mips.elf File opened for reading /proc/798/comm bin.mips.elf File opened for reading /proc/805/comm bin.mips.elf File opened for reading /proc/8/comm bin.mips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 724 bin.mips.elf