Analysis
- max time kernel
151s - max time network
153s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
06/07/2026, 18:19
Static task
static1
Behavioral task
behavioral1
Sample
mipsel
Resource
debian12-mipsel-20260513-en
7 signatures
150 seconds
General
- Target mipsel
- Size 123KB
- Sample260706-wyncpsbv5z
- SHA256 d54666088bc7da30f79d3436e7eb8c8753884b4803cb91c9ada58e20cf9e0b0a
- MD5 bc3ed4efdac74bc3b4193062cafdbee8
- SHA1 43210bc4185bb47c92fed62dd0a94a6b53f3f59e
- SHA512 96ea1abfcc90c66276ac3ecf4cf13ca4e97f6a7c14abfd0f56cc9bb245bdc863ede84b4976101dc5ebf63d65bb03862c436ed5f60aed459c813cbbdc15b287d2
- SSDEEP 1536:OaDvChObU9/olcu2AVWXmvwm15poi4o9Ioq80c6GYDTSvIlvg+xRLTPyPJkovQJa:pbCOhZ1S80c6GoSwrryPJkIX6/9
- TLSH T15EC30909BFA00FFBE89FDD3705E90B1A258C691753A93F3A7574D818F15A24B0AD3864
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Renames itself 1 IoCs
pid Process 818 mipsel - Reads MAC address of network interface 2 TTPs 1 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
description ioc Process File opened for reading /sys/class/net/enp0s19/address mipsel - Reads network interface configuration 2 TTPs 2 IoCs
Fetches information about one or more active network interfaces.
description ioc Process File opened for reading /sys/class/net/enp0s19/flags mipsel File opened for reading /sys/class/net/enp0s19/carrier mipsel - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself udhcpc 818 mipsel - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/class/net mipsel -
description ioc Process File opened for reading /proc/self/exe mipsel - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 818 mipsel