Analysis
- max time kernel
151s - max time network
143s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
05/06/2026, 05:22
Static task
static1
Behavioral task
behavioral1
Sample
data_mipsel.elf
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
8 signatures
150 seconds
General
- Target data_mipsel.elf
- Size 147KB
- Sample260605-f2s5csbs8s
- SHA256 c7b379b588dcd3801157e0cfb817bf0484839be8a2e8515654e7a78d17bf3744
- MD5 afa550e775ce301b5b9f08a8f62671c4
- SHA1 c6067dae6784360860c8f2d627c7e29d94fb5216
- SHA512 8b0b1ae63ee527974220829a6dbcf35e18209a7ac3c90d72bf48535de954ad24c3594a09094c69535080c0e03a9844cdec979887949bfcb9e7ccd7ca0299539a
- SSDEEP 1536:7ir3WAVCk1XGm3KtrbN/EEy83bJ7rRip0MKG1u+u8SwID4mAZgTvLfiZy48cyh6v:Wr4GGm3Ktrw8LV8wEmcifihvhIStIM
- TLSH T1C0E3E60AAF600FFBDC6BDD7702E90B1229CCB95716A53F797534E818B50A18B4AD3C64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp data_mipsel.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/35/maps data_mipsel.elf File opened for reading /proc/336/maps data_mipsel.elf File opened for reading /proc/705/maps data_mipsel.elf File opened for reading /proc/793/maps data_mipsel.elf File opened for reading /proc/48/maps data_mipsel.elf File opened for reading /proc/59/maps data_mipsel.elf File opened for reading /proc/14/maps data_mipsel.elf File opened for reading /proc/16/maps data_mipsel.elf File opened for reading /proc/19/maps data_mipsel.elf File opened for reading /proc/679/maps data_mipsel.elf File opened for reading /proc/18/maps data_mipsel.elf File opened for reading /proc/34/maps data_mipsel.elf File opened for reading /proc/407/maps data_mipsel.elf File opened for reading /proc/4/maps data_mipsel.elf File opened for reading /proc/812/maps data_mipsel.elf File opened for reading /proc/119/maps data_mipsel.elf File opened for reading /proc/678/maps data_mipsel.elf File opened for reading /proc/832/maps data_mipsel.elf File opened for reading /proc/834/maps data_mipsel.elf File opened for reading /proc/835/maps data_mipsel.elf File opened for reading /proc/47/maps data_mipsel.elf File opened for reading /proc/137/maps data_mipsel.elf File opened for reading /proc/778/maps data_mipsel.elf File opened for reading /proc/821/maps data_mipsel.elf File opened for reading /proc/24/maps data_mipsel.elf File opened for reading /proc/762/maps data_mipsel.elf File opened for reading /proc/13/maps data_mipsel.elf File opened for reading /proc/21/maps data_mipsel.elf File opened for reading /proc/432/maps data_mipsel.elf File opened for reading /proc/6/maps data_mipsel.elf File opened for reading /proc/9/maps data_mipsel.elf File opened for reading /proc/12/maps data_mipsel.elf File opened for reading /proc/25/maps data_mipsel.elf File opened for reading /proc/37/maps data_mipsel.elf File opened for reading /proc/698/maps data_mipsel.elf File opened for reading /proc/772/maps data_mipsel.elf File opened for reading /proc/112/maps data_mipsel.elf File opened for reading /proc/113/maps data_mipsel.elf File opened for reading /proc/2/maps data_mipsel.elf File opened for reading /proc/7/maps data_mipsel.elf File opened for reading /proc/23/maps data_mipsel.elf File opened for reading /proc/27/maps data_mipsel.elf File opened for reading /proc/28/maps data_mipsel.elf File opened for reading /proc/413/maps data_mipsel.elf File opened for reading /proc/11/maps data_mipsel.elf File opened for reading /proc/17/maps data_mipsel.elf File opened for reading /proc/26/maps data_mipsel.elf File opened for reading /proc/32/maps data_mipsel.elf File opened for reading /proc/58/maps data_mipsel.elf File opened for reading /proc/109/maps data_mipsel.elf File opened for reading /proc/202/maps data_mipsel.elf File opened for reading /proc/806/maps data_mipsel.elf File opened for reading /proc/22/maps data_mipsel.elf File opened for reading /proc/411/maps data_mipsel.elf File opened for reading /proc/831/maps data_mipsel.elf File opened for reading /proc/5/maps data_mipsel.elf File opened for reading /proc/29/maps data_mipsel.elf File opened for reading /proc/138/maps data_mipsel.elf File opened for reading /proc/181/maps data_mipsel.elf File opened for reading /proc/766/maps data_mipsel.elf File opened for reading /proc/31/maps data_mipsel.elf File opened for reading /proc/33/maps data_mipsel.elf File opened for reading /proc/42/maps data_mipsel.elf File opened for reading /proc/116/maps data_mipsel.elf - Changes its process name 3 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself cpuhp/0 806 data_mipsel.elf Changes the process name, possibly in an attempt to hide itself kworker/0:1 806 data_mipsel.elf Changes the process name, possibly in an attempt to hide itself ksoftirqd/1 834 data_mipsel.elf - Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp data_mipsel.elf File opened for reading /proc/net/tcp6 data_mipsel.elf -
description ioc Process File opened for reading /proc/116/stat data_mipsel.elf File opened for reading /proc/705/cmdline data_mipsel.elf File opened for reading /proc/119/fd data_mipsel.elf File opened for reading /proc/834/fd data_mipsel.elf File opened for reading /proc/3/cmdline data_mipsel.elf File opened for reading /proc/22/comm data_mipsel.elf File opened for reading /proc/58/comm data_mipsel.elf File opened for reading /proc/202/comm data_mipsel.elf File opened for reading /proc/29/stat data_mipsel.elf File opened for reading /proc/30/comm data_mipsel.elf File opened for reading /proc/30/stat data_mipsel.elf File opened for reading /proc/432/cmdline data_mipsel.elf File opened for reading /proc/30/fd data_mipsel.elf File opened for reading /proc/59/fd data_mipsel.elf File opened for reading /proc/116/comm data_mipsel.elf File opened for reading /proc/self/mountinfo data_mipsel.elf File opened for reading /proc/4/stat data_mipsel.elf File opened for reading /proc/28/stat data_mipsel.elf File opened for reading /proc/23/fd data_mipsel.elf File opened for reading /proc/11/comm data_mipsel.elf File opened for reading /proc/35/stat data_mipsel.elf File opened for reading /proc/42/comm data_mipsel.elf File opened for reading /proc/181/comm data_mipsel.elf File opened for reading /proc/336/fd data_mipsel.elf File opened for reading /proc/679/cmdline data_mipsel.elf File opened for reading /proc/27/fd data_mipsel.elf File opened for reading /proc/27/comm data_mipsel.elf File opened for reading /proc/821/cmdline data_mipsel.elf File opened for reading /proc/58/fd data_mipsel.elf File opened for reading /proc/404/fd data_mipsel.elf File opened for reading /proc/48/cmdline data_mipsel.elf File opened for reading /proc/58/stat data_mipsel.elf File opened for reading /proc/59/cmdline data_mipsel.elf File opened for reading /proc/15/fd data_mipsel.elf File opened for reading /proc/113/fd data_mipsel.elf File opened for reading /proc/806/fd data_mipsel.elf File opened for reading /proc/2/comm data_mipsel.elf File opened for reading /proc/404/cmdline data_mipsel.elf File opened for reading /proc/778/stat data_mipsel.elf File opened for reading /proc/6/fd data_mipsel.elf File opened for reading /proc/42/stat data_mipsel.elf File opened for reading /proc/119/comm data_mipsel.elf File opened for reading /proc/698/fd data_mipsel.elf File opened for reading /proc/9/comm data_mipsel.elf File opened for reading /proc/35/cmdline data_mipsel.elf File opened for reading /proc/48/comm data_mipsel.elf File opened for reading /proc/53/cmdline data_mipsel.elf File opened for reading /proc/110/comm data_mipsel.elf File opened for reading /proc/413/comm data_mipsel.elf File opened for reading /proc/11/cmdline data_mipsel.elf File opened for reading /proc/18/comm data_mipsel.elf File opened for reading /proc/23/stat data_mipsel.elf File opened for reading /proc/48/stat data_mipsel.elf File opened for reading /proc/432/comm data_mipsel.elf File opened for reading /proc/1/fd data_mipsel.elf File opened for reading /proc/19/fd data_mipsel.elf File opened for reading /proc/137/fd data_mipsel.elf File opened for reading /proc/16/stat data_mipsel.elf File opened for reading /proc/24/stat data_mipsel.elf File opened for reading /proc/27/stat data_mipsel.elf File opened for reading /proc/9/fd data_mipsel.elf File opened for reading /proc/821/fd data_mipsel.elf File opened for reading /proc/7/cmdline data_mipsel.elf File opened for reading /proc/8/stat data_mipsel.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 803 data_mipsel.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.d_lock data_mipsel.elf