Analysis
- max time kernel
151s - max time network
156s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
28/07/2026, 18:28
Static task
static1
Behavioral task
behavioral1
Sample
2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
4 signatures
150 seconds
General
- Target 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc
- Size 205KB
- Sample260728-w4mncsbb33
- SHA256 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc
- MD5 4277cdd3e6054c9f57b7bf6f6f2473a4
- SHA1 441adc08087f337902ad2ebcef3951c69211e3d1
- SHA512 ba8c5aa1504e18a027d9f6ba3f3ded0d8a60336cddac633891953033f7c140724cc805c4177d128543c0e9a4f679246f2a0e599045ad790f54fd66e1f6f78930
- SSDEEP 3072:ZmKcHJ3a7X02mdssgoOZujlkHAabWqxQ8Z:Zmv3Umgo1jaAabBxQ8
- TLSH T1E724B60AAF610FFBD8AFDE3746E90B0625CC650722A83B3A3574D924F54A54F49D3C68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/xs.main 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself -sh 809 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc -
description ioc Process File opened for reading /proc/797/stat 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/817/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/829/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/112/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/340/stat 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/9/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/21/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/10/status 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/42/stat 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/337/cmdline 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/827/exe 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/37/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/28/status 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/817/status 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/828/cmdline 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/7/stat 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/112/stat 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/663/cmdline 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/26/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/767/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/806/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/2/status 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/44/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/113/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/24/cmdline 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/827/stat 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/829/cmdline 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/15/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/20/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/114/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/380/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/17/status 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/20/status 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/29/stat 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/828/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/9/cmdline 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/25/status 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/833/cmdline 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/844/stat 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/4/status 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/31/stat 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/118/exe 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/395/status 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/395/cmdline 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/12/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/21/cmdline 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/32/stat 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/48/stat 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/31/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/21/status 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/30/stat 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/30/cmdline 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/32/status 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/111/stat 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/707/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/8/stat 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/33/cmdline 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/14/cmdline 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/59/status 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/827/comm 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/827/cmdline 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/28/cmdline 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/35/task/35/children 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc File opened for reading /proc/58/stat 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/init.d/xs.main
- Size 81B
- SHA256 36fc822e58af1c666b9fa656a4a451a612e0225017555b597913655448efe671
- MD5 8086219481e591d2378891b56b106218
- SHA1 e9918bea0d4cc508a3795f6d5d695ba5bc5956cb
- SHA512 478fb910520ca8080d5fa1ea0f3965646590e55f16ac16240fbfb030f26fc7bf60f3d6afa90eafa119b022e5efb06cee1fb9ca712595425f7f6320516dc94e63
- TLSH T10FA02473CC0100CC4115C45C1100FD1051C1303D3043503C0431457FDD5C70334DF541
- MD5 SHA1 SHA512 TLSH