Analysis
- max time kernel
1s - platform
debian-9_mipsel - resource
debian9-mipsel-20260513-en - resource tags
arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem - submitted
18/08/2026, 04:06
Static task
static1
Behavioral task
behavioral1
Sample
93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
Resource
debian9-armhf-20260513-en
debian-9-armhf
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
Resource
debian9-mipsbe-20260513-en
debian-9-mips
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
4 signatures
150 seconds
General
- Target 93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
- Size 1KB
- Sample260818-epekrsdr3w
- SHA256 93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
- MD5 94b2ed5fd20ce8398e62756e2b8c6303
- SHA1 6cd683aae5096741660d8617421b029c8290a8bf
- SHA512 4cde6f82fe0f078ebaad8da56cf7066db2b1254c7740b67c7b4909c3b8f210f153834f087954be6ef6eb32be4724e6cb9a2901c6e635c7f2a8c11341ee695f53
- TLSH T14B21D0C5F8A8DEB1BDB8717A806A120115DB695F1477B13110F2C8641B0C59DD5BEB33
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep - Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
description ioc Process File opened for reading /proc/82/status pgrep File opened for reading /proc/661/fd ss File opened for reading /proc/687/fd ss File opened for reading /proc/10/attr/current ss File opened for reading /proc/36/attr/current ss File opened for reading /proc/73/fd ss File opened for reading /proc/11/status pgrep File opened for reading /proc/677/status pgrep File opened for reading /proc/9/cmdline pgrep File opened for reading /proc/76/cmdline pgrep File opened for reading /proc/716/status pgrep File opened for reading /proc/8/attr/current ss File opened for reading /proc/14/attr/current ss File opened for reading /proc/126/fd ss File opened for reading /proc/686/attr/current ss File opened for reading /proc/5/fd ss File opened for reading /proc/332/attr/current ss File opened for reading /proc/17/attr/current ss File opened for reading /proc/14/attr/current ss File opened for reading /proc/335/fd ss File opened for reading /proc/381/attr/current ss File opened for reading /proc/9/fd ss File opened for reading /proc/335/fd ss File opened for reading /proc/381/stat ss File opened for reading /proc/109/status pgrep File opened for reading /proc/335/status pgrep File opened for reading /proc/332/stat ss File opened for reading /proc/705/status pgrep File opened for reading /proc/3/attr/current ss File opened for reading /proc/710/attr/current ss File opened for reading /proc/21/cmdline pgrep File opened for reading /proc/109/fd ss File opened for reading /proc/176/stat ss File opened for reading /proc/12/attr/current ss File opened for reading /proc/22/cmdline pgrep File opened for reading /proc/382/status pgrep File opened for reading /proc/720/status pgrep File opened for reading /proc/126/attr/current ss File opened for reading /proc/716/attr/current ss File opened for reading /proc/7/fd ss File opened for reading /proc/18/attr/current ss File opened for reading /proc/82/fd ss File opened for reading /proc/70/cmdline pgrep File opened for reading /proc/76/attr/current ss File opened for reading /proc/714/status pgrep File opened for reading /proc/240/stat ss File opened for reading /proc/716/stat ss File opened for reading /proc/712/status pgrep File opened for reading /proc/5/attr/current ss File opened for reading /proc/154/fd ss File opened for reading /proc/677/stat ss File opened for reading /proc/125/attr/current ss File opened for reading /proc/385/attr/current ss File opened for reading /proc/745/fd ss File opened for reading /proc/23/cmdline pgrep File opened for reading /proc/337/attr/current ss File opened for reading /proc/74/attr/current ss File opened for reading /proc/75/attr/current ss File opened for reading /proc/77/attr/current ss File opened for reading /proc/6/status pgrep File opened for reading /proc/74/cmdline pgrep File opened for reading /proc/81/cmdline pgrep File opened for reading /proc/19/fd ss File opened for reading /proc/240/attr/current ss
Processes
-
/tmp/93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b/tmp/93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b1⤵PID:714
-
/bin/grepgrep -q :4432⤵PID:718
-
-
/bin/ssss -tlnp2⤵
- Reads runtime system information
PID:717
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"2⤵PID:734
-
-
/bin/systemctlsystemctl start cnc.service2⤵
- Enumerates kernel/hardware configuration
PID:736
-
-
/bin/grepgrep -q :802⤵PID:744
-
-
/bin/ssss -tlnp2⤵
- Reads runtime system information
PID:743
-
-
/usr/bin/pgreppgrep -f auto_pwner_v142⤵
- Reads CPU attributes
- Reads runtime system information
PID:747
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"2⤵PID:749
-
-
/bin/systemctlsystemctl start botpwner.service2⤵
- Enumerates kernel/hardware configuration
PID:751
-