Analysis
- max time kernel
4s - max time network
9s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
30/07/2026, 08:41
Static task
static1
Behavioral task
behavioral1
Sample
mipsel.elf
Resource
debian12-mipsel-20260513-en
5 signatures
150 seconds
General
- Target mipsel.elf
- Size 184KB
- Sample260730-klkkhathrd
- SHA256 8f312413d911af37f7636c63f33fb48b5f6d15c68a04a3db42a3189e24690d3f
- MD5 d0896c775a312fafa86efb84d046a191
- SHA1 98e50e21c30d20a71e97a652d9f309d622abceec
- SHA512 1756697859a8a0ee2d4e674e62f9c96743d862fc42737f8cd43c1d94a86208725d79b7804514e5ad028dec5480d46ee2a4a8e44be162456f4f247d2acb16e957
- SSDEEP 3072:3KFpD56nRrrnH5lGNWc4jS0IHW+Lu8XtMZ7cLVdMoCMNyaPR:3KFpDgnRrrnHvGNWjjS0WW+Lu8mxyCMD
- TLSH T127044B63FE606FEFC02D8EB046BDC21701D598D2A6C58A6BB37C4DCD7A6965306835C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 801 mipsel.elf - Changes its process name 3 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself ksoftirqd/0 801 mipsel.elf Changes the process name, possibly in an attempt to hide itself dropbear 804 mipsel.elf Changes the process name, possibly in an attempt to hide itself kswapd 805 mipsel.elf -
description ioc Process File opened for reading /proc/stat mipsel.elf File opened for reading /proc/meminfo mipsel.elf File opened for reading /proc/mounts mipsel.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 801 mipsel.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.sys_lock mipsel.elf
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.sys_lock
- Size 4B
- SHA256 0649820fba7dcee6ab300b5e63ad9b37c1cef2128e8a9e65219982887fb8b643
- MD5 8f39c375e37f844f665d1043bf59d70c
- SHA1 49d24be0a03053524f16c2710393cd2ad0c44072
- SHA512 a6209cd8255e720be6a9357a3c84b4bb47a3d29a6aab23a23f4420d1f93a6ca4cf949c416e1858a7e6a64a514a8b958c46a35ee16d6159c10b2faf60953ff5cc
- MD5 SHA1 SHA512