04e16f35916321dab115dab2fd960623dc43e29f2c24f2094b492e5b48ffb8c8

Analysis

max time kernel
176s
max time network
204s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
28/06/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
flutter.mips.elf
Size 235KB
Sample260628-eergkse14z
SHA256 04e16f35916321dab115dab2fd960623dc43e29f2c24f2094b492e5b48ffb8c8
MD5 f30f578b47dda1aa1c7e5e202f2168c6
SHA1 fe9d748ac48fb5aac334f44c8e2557501acb6ffb
SHA512 31443d8ea9f15031c805cd1ce92800528d2bb172c3b8b01db31291d70c4e8d66a351b27cb69cdb43285eafd4736ddfd5cd5db11c2acbb67f99949e6c16558042
SSDEEP 6144:Ic4e/ON6IYZhMY6GsMMZf0TsyfHJLXDX6/WM8+:IVedIYZ9mas6XDKOM7
TLSH
T142345C4B77A08F90E275D93006F34AA39AB9129317E39545E2BDDE113E6034C6C2FFA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	flutter.mips.elf
File opened for modification	/dev/misc/watchdog	flutter.mips.elf

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/flutter	flutter.mips.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	flutter.mips.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	flutter.mips.elf

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/network-dispatch.service	flutter.mips.elf

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/network-dispatch	flutter.mips.elf

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	irqbalance	707	flutter.mips.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/2:1]	707	flutter.mips.elf
Changes the process name, possibly in an attempt to hide itself	ntpd	709	flutter.mips.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	flutter.mips.elf

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/24/fd	flutter.mips.elf
File opened for reading	/proc/75/fd	flutter.mips.elf
File opened for reading	/proc/753/fd	flutter.mips.elf
File opened for reading	/proc/754/fd	flutter.mips.elf
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/672/cmdline	flutter.mips.elf
File opened for reading	/proc/755/cmdline	flutter.mips.elf
File opened for reading	/proc/6/fd	flutter.mips.elf
File opened for reading	/proc/7/fd	flutter.mips.elf
File opened for reading	/proc/16/fd	flutter.mips.elf
File opened for reading	/proc/707/fd	flutter.mips.elf
File opened for reading	/proc/711/fd	flutter.mips.elf
File opened for reading	/proc/81/fd	flutter.mips.elf
File opened for reading	/proc/758/fd	flutter.mips.elf
File opened for reading	/proc/762/fd	flutter.mips.elf
File opened for reading	/proc/763/fd	flutter.mips.elf
File opened for reading	/proc/703/cmdline	flutter.mips.elf
File opened for reading	/proc/704/cmdline	flutter.mips.elf
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/19/fd	flutter.mips.elf
File opened for reading	/proc/68/fd	flutter.mips.elf
File opened for reading	/proc/82/fd	flutter.mips.elf
File opened for reading	/proc/110/fd	flutter.mips.elf
File opened for reading	/proc/751/fd	flutter.mips.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/716/cmdline	flutter.mips.elf
File opened for reading	/proc/5/fd	flutter.mips.elf
File opened for reading	/proc/119/fd	flutter.mips.elf
File opened for reading	/proc/701/fd	flutter.mips.elf
File opened for reading	/proc/703/fd	flutter.mips.elf
File opened for reading	/proc/756/fd	flutter.mips.elf
File opened for reading	/proc/70/fd	flutter.mips.elf
File opened for reading	/proc/708/cmdline	flutter.mips.elf
File opened for reading	/proc/21/fd	flutter.mips.elf
File opened for reading	/proc/37/fd	flutter.mips.elf
File opened for reading	/proc/333/fd	flutter.mips.elf
File opened for reading	/proc/379/fd	flutter.mips.elf
File opened for reading	/proc/671/cmdline	flutter.mips.elf
File opened for reading	/proc/8/fd	flutter.mips.elf
File opened for reading	/proc/15/fd	flutter.mips.elf
File opened for reading	/proc/375/fd	flutter.mips.elf
File opened for reading	/proc/426/fd	flutter.mips.elf
File opened for reading	/proc/672/fd	flutter.mips.elf
File opened for reading	/proc/835/cmdline	flutter.mips.elf
File opened for reading	/proc/746/cmdline	flutter.mips.elf
File opened for reading	/proc/761/cmdline	flutter.mips.elf
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/76/fd	flutter.mips.elf
File opened for reading	/proc/696/fd	flutter.mips.elf
File opened for reading	/proc/746/fd	flutter.mips.elf
File opened for reading	/proc/self/exe	flutter.mips.elf
File opened for reading	/proc/10/fd	flutter.mips.elf
File opened for reading	/proc/232/fd	flutter.mips.elf
File opened for reading	/proc/671/fd	flutter.mips.elf
File opened for reading	/proc/755/fd	flutter.mips.elf
File opened for reading	/proc/795/cmdline	flutter.mips.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/77/fd	flutter.mips.elf
File opened for reading	/proc/143/fd	flutter.mips.elf
File opened for reading	/proc/799/cmdline	flutter.mips.elf
File opened for reading	/proc/701/cmdline	flutter.mips.elf
File opened for reading	/proc/763/cmdline	flutter.mips.elf
File opened for reading	/proc/2/fd	flutter.mips.elf

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
706	flutter.mips.elf

/tmp/flutter.mips.elf
/tmp/flutter.mips.elf
1⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Enumerates active TCP sockets
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Changes its process name
- Reads system network configuration
- Reads runtime system information
- System Network Configuration Discovery
PID:706
- /usr/local/sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:714
- /usr/local/bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:714
- /usr/sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:714
- /usr/bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:714
- /sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:714
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:714
- /usr/local/sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:751
- /usr/local/bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:751
- /usr/sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:751
- /usr/bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:751
- /sbin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  PID:751
- /bin/systemctl
  systemctl enable network-dispatch.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:751

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

flutter

Path /etc/cron.d/flutter
Size 37B
SHA256 712af7a4db9640f2f99fc2cf77b1fb48e70a6e86ced5208c4436d09dab84a0d7
MD5 a481808f879f6fe7f0a78bfa8b3fa7f2
SHA1 5073947601b0225eca171c037a2aa1fa43ab4a9c
SHA512 65e570ef7cdb515fe9fce9d6ee0dd1aad873f3b90c3aa10cb34199f6564877f544beeb26cccc6aec7052e9c02032e958bb7a3986dd9951fde710f7ba024487ec
MD5 SHA1 SHA512

Submit Download

network-dispatch.service

Path /etc/systemd/system/network-dispatch.service
Size 228B
SHA256 f0a4522d9cacf37bc711ef07c7a07d2627ac3fb2a25e13e1695db14896da415e
MD5 93d4d91e631d6cc85d978e996f3316b9
SHA1 9fc4ded5573510502cbb231b2c8d3ab5fc2d5503
SHA512 c0b9d9ac33434e11a8ccebf386492e4baa7206cb61968694e06d4eb911eaee4ffa74e7b106a402bfb8bfd1c3b725fd29f9d59b8fb090b643dbb3f42a3db409fe
TLSH
T149D0A7A2DAB05091CA1618764F977B50894521401D8EA2BD0A952F4546D2245502DA5E
MD5 SHA1 SHA512 TLSH

Submit Download

network-dispatch

Path /usr/local/bin/network-dispatch
Size 235KB
SHA256 04e16f35916321dab115dab2fd960623dc43e29f2c24f2094b492e5b48ffb8c8
MD5 f30f578b47dda1aa1c7e5e202f2168c6
SHA1 fe9d748ac48fb5aac334f44c8e2557501acb6ffb
SHA512 31443d8ea9f15031c805cd1ce92800528d2bb172c3b8b01db31291d70c4e8d66a351b27cb69cdb43285eafd4736ddfd5cd5db11c2acbb67f99949e6c16558042
SSDEEP 6144:Ic4e/ON6IYZhMY6GsMMZf0TsyfHJLXDX6/WM8+:IVedIYZ9mas6XDKOM7
TLSH
T142345C4B77A08F90E275D93006F34AA39AB9129317E39545E2BDDE113E6034C6C2FFA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads