Analysis
- max time kernel
96s - max time network
151s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
20/06/2026, 03:52
Behavioral task
behavioral1
Sample
pmips.elf
Resource
debian9-mipsbe-20260513-en
debian-9-mips
6 signatures
150 seconds
General
- Target pmips.elf
- Size 86KB
- Sample260620-efdbcac13m
- SHA256 37733e5966cf4129c79c419725fbc2f7bcdac446683d966107bb3065d959422f
- MD5 1fe5ad321a1e6f18b618bcb5a2c2edf1
- SHA1 33e75e2fb2aabe15a4cb564a952e499cb9483ff2
- SHA512 89414b9034400cc3750b3e9f638fc0f66756e57d9d5233fb9774029282d6c98b921f66190f110361e4989b24c45a260dd85c43efa5b7080719a1f832a13b3199
- SSDEEP 1536:T5MVURHdsQwKIVpERvz1+TIeIKSYImjsHCZc9vru+VJuR:FMVUR6QuVSRL1Lf+IHiZKru+VQR
- TLSH T1D08302BA6E0190E1CD7AC9B90C7803875F3A8F925309DC81E20DED4D9D4E5855DE86F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 719 pmips.elf - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog pmips.elf File opened for modification /dev/misc/watchdog pmips.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself scanbot 719 pmips.elf -
description ioc Process File opened for reading /proc/357cmdline pmips.elf File opened for reading /proc/687cmdline pmips.elf File opened for reading /proc/788cmdline pmips.elf File opened for reading /proc/791cmdline pmips.elf File opened for reading /proc/807cmdline pmips.elf File opened for reading /proc/812cmdline pmips.elf File opened for reading /proc/813cmdline pmips.elf File opened for reading /proc/155cmdline pmips.elf File opened for reading /proc/778cmdline pmips.elf File opened for reading /proc/822cmdline pmips.elf File opened for reading /proc/792cmdline pmips.elf File opened for reading /proc/745cmdline pmips.elf File opened for reading /proc/765cmdline pmips.elf File opened for reading /proc/10cmdline pmips.elf File opened for reading /proc/127cmdline pmips.elf File opened for reading /proc/749cmdline pmips.elf File opened for reading /proc/768cmdline pmips.elf File opened for reading /proc/805cmdline pmips.elf File opened for reading /proc/806cmdline pmips.elf File opened for reading /proc/826cmdline pmips.elf File opened for reading /proc/5cmdline pmips.elf File opened for reading /proc/73cmdline pmips.elf File opened for reading /proc/161cmdline pmips.elf File opened for reading /proc/737cmdline pmips.elf File opened for reading /proc/751cmdline pmips.elf File opened for reading /proc/803cmdline pmips.elf File opened for reading /proc/15cmdline pmips.elf File opened for reading /proc/726cmdline pmips.elf File opened for reading /proc/732cmdline pmips.elf File opened for reading /proc/738cmdline pmips.elf File opened for reading /proc/770cmdline pmips.elf File opened for reading /proc/771cmdline pmips.elf File opened for reading /proc/773cmdline pmips.elf File opened for reading /proc/110cmdline pmips.elf File opened for reading /proc/733cmdline pmips.elf File opened for reading /proc/757cmdline pmips.elf File opened for reading /proc/740cmdline pmips.elf File opened for reading /proc/748cmdline pmips.elf File opened for reading /proc/8cmdline pmips.elf File opened for reading /proc/16cmdline pmips.elf File opened for reading /proc/79cmdline pmips.elf File opened for reading /proc/176cmdline pmips.elf File opened for reading /proc/761cmdline pmips.elf File opened for reading /proc/784cmdline pmips.elf File opened for reading /proc/715cmdline pmips.elf File opened for reading /proc/716cmdline pmips.elf File opened for reading /proc/718cmdline pmips.elf File opened for reading /proc/774cmdline pmips.elf File opened for reading /proc/783cmdline pmips.elf File opened for reading /proc/793cmdline pmips.elf File opened for reading /proc/795cmdline pmips.elf File opened for reading /proc/800cmdline pmips.elf File opened for reading /proc/779cmdline pmips.elf File opened for reading /proc/790cmdline pmips.elf File opened for reading /proc/7cmdline pmips.elf File opened for reading /proc/11cmdline pmips.elf File opened for reading /proc/353cmdline pmips.elf File opened for reading /proc/360cmdline pmips.elf File opened for reading /proc/759cmdline pmips.elf File opened for reading /proc/769cmdline pmips.elf File opened for reading /proc/802cmdline pmips.elf File opened for reading /proc/804cmdline pmips.elf File opened for reading /proc/14cmdline pmips.elf File opened for reading /proc/750cmdline pmips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 719 pmips.elf