Analysis
- max time kernel
3s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
18/08/2026, 04:06
Static task
static1
Behavioral task
behavioral1
Sample
93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
Resource
debian9-armhf-20260513-en
debian-9-armhf
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
Resource
debian9-mipsbe-20260513-en
debian-9-mips
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
4 signatures
150 seconds
General
- Target 93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
- Size 1KB
- Sample260818-epekrsdr3w
- SHA256 93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
- MD5 94b2ed5fd20ce8398e62756e2b8c6303
- SHA1 6cd683aae5096741660d8617421b029c8290a8bf
- SHA512 4cde6f82fe0f078ebaad8da56cf7066db2b1254c7740b67c7b4909c3b8f210f153834f087954be6ef6eb32be4724e6cb9a2901c6e635c7f2a8c11341ee695f53
- TLSH T14B21D0C5F8A8DEB1BDB8717A806A120115DB695F1477B13110F2C8641B0C59DD5BEB33
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep - Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
description ioc Process File opened for reading /proc/692/attr/current ss File opened for reading /proc/23/cmdline pgrep File opened for reading /proc/173/cmdline pgrep File opened for reading /proc/37/fd ss File opened for reading /proc/665/fd ss File opened for reading /proc/308/cmdline pgrep File opened for reading /proc/310/attr/current ss File opened for reading /proc/357/stat ss File opened for reading /proc/700/fd ss File opened for reading /proc/75/attr/current ss File opened for reading /proc/731/attr/current ss File opened for reading /proc/24/cmdline pgrep File opened for reading /proc/699/status pgrep File opened for reading /proc/3/fd ss File opened for reading /proc/223/fd ss File opened for reading /proc/1/cmdline pgrep File opened for reading /proc/24/status pgrep File opened for reading /proc/700/status pgrep File opened for reading /proc/14/fd ss File opened for reading /proc/709/attr/current ss File opened for reading /proc/81/status pgrep File opened for reading /proc/20/attr/current ss File opened for reading /proc/736/cmdline pgrep File opened for reading /proc/6/fd ss File opened for reading /proc/657/stat ss File opened for reading /proc/self/stat systemctl File opened for reading /proc/365/fd ss File opened for reading /proc/692/attr/current ss File opened for reading /proc/349/cmdline pgrep File opened for reading /proc/709/status pgrep File opened for reading /proc/666/status pgrep File opened for reading /proc/4/attr/current ss File opened for reading /proc/694/attr/current ss File opened for reading /proc/705/fd ss File opened for reading /proc/13/fd ss File opened for reading /proc/79/attr/current ss File opened for reading /proc/305/cmdline pgrep File opened for reading /proc/14/attr/current ss File opened for reading /proc/21/attr/current ss File opened for reading /proc/filesystems systemctl File opened for reading /proc/1/attr/current ss File opened for reading /proc/173/attr/current ss File opened for reading /proc/305/attr/current ss File opened for reading /proc/305/stat ss File opened for reading /proc/666/fd ss File opened for reading /proc/22/cmdline pgrep File opened for reading /proc/1/attr/current ss File opened for reading /proc/12/fd ss File opened for reading /proc/125/attr/current ss File opened for reading /proc/15/attr/current ss File opened for reading /proc/75/cmdline pgrep File opened for reading /proc/699/cmdline pgrep File opened for reading /proc/filesystems ss File opened for reading /proc/76/attr/current ss File opened for reading /proc/308/attr/current ss File opened for reading /proc/37/fd ss File opened for reading /proc/70/attr/current ss File opened for reading /proc/365/attr/current ss File opened for reading /proc/707/attr/current ss File opened for reading /proc/24/fd ss File opened for reading /proc/708/attr/current ss File opened for reading /proc/4/attr/current ss File opened for reading /proc/6/attr/current ss File opened for reading /proc/351/cmdline pgrep
Processes
-
/tmp/93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b/tmp/93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b1⤵PID:703
-
/bin/ssss -tlnp2⤵
- Reads runtime system information
PID:706
-
-
/bin/grepgrep -q :4432⤵PID:707
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"2⤵PID:722
-
-
/bin/systemctlsystemctl start cnc.service2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:724
-
-
/bin/grepgrep -q :802⤵PID:732
-
-
/bin/ssss -tlnp2⤵
- Reads runtime system information
PID:731
-
-
/usr/bin/pgreppgrep -f auto_pwner_v142⤵
- Reads CPU attributes
- Reads runtime system information
PID:735
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"2⤵PID:738
-
-
/bin/systemctlsystemctl start botpwner.service2⤵
- Enumerates kernel/hardware configuration
PID:740
-