Analysis
- max time kernel
151s - max time network
156s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
20/08/2026, 02:51
General
- Target a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf
- Size 76KB
- Sample260820-dcd8ssdp7z
- SHA256 a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb
- MD5 3ab1026b605a0ecbe06b4bc58b630083
- SHA1 ae466560a84714229bc7e9b50427ffc95508f737
- SHA512 147298e7d03d9aed624a42826c24bc53f395f6b0ca24d78bc403540aa114a6fbff76092e2f0df56180fb8ca4352025c6f6357ab1d503c5f98fb33bd1f0abc496
- SSDEEP 1536:MjXzal1s3KfgxvJoewJKh8O7FPM1ZEgwGmu/rJ9iUnA/:MjXz84s2vPwJiy1ZE8msXi4O
- TLSH T1A17302CDFAA0E283CE8F1935022F77410B39E59673BA5FC813460E90A56E54B7D2E970
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 807 a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/flylegit 807 a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf Changes the process name, possibly in an attempt to hide itself kworker/0:0 812 a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf -
description ioc Process File opened for reading /proc/12/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/22/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/762/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/775/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/22/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/352/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/663/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/810/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/767/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/379/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/812/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/4/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/26/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/self/maps a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/21/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/781/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/812/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/35/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/28/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/389/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/797/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/14/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/389/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/20/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/17/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/42/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/406/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/767/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/21/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/29/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/34/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/12/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/59/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/137/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/380/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/677/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/111/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/30/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/16/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/118/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/34/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/14/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/25/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/805/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/431/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/32/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/118/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/678/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/678/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/19/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/326/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/27/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/705/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/814/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/15/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/42/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/47/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/136/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/394/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/113/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/405/cmdline a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/meminfo a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/406/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf File opened for reading /proc/677/comm a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb.elf
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /run/.disabled.list
- Size 14B
- SHA256 363c06cb1b00b9f4b9931424c34a0ed843141784aa9fe88137b029745032d6c4
- MD5 67b255a08c28862963c978aaefcfc238
- SHA1 3a48f1a2ebc3ddf68fc62ea02dad1581988a3463
- SHA512 9bde8f984168046c0d081f495f109cdcce429d396583db8c2886be4b72be73810a6c6d9b53d56507ee08d73fe689b8fe683f5fbde06b5d107e0d5f6f41c4a004
- MD5 SHA1 SHA512
- Path /run/.disabled.list
- Size 27B
- SHA256 aed31b49fed23bdd71b8596baccf79a3bedbb4e3f0be05f9bcbcdc996e4ee5bb
- MD5 7f5d2d301d6334558bae25364f0448ed
- SHA1 db875b380e2b1b37d7c12e94b5d312b5c408424c
- SHA512 954ec574c0147cb9184f3fb2588bd7229e42e7f7b6cb0c10d3ed3ca6d4ba53809a5a087b56a8c349873a0ab3a7d35b6f24816eaeb419c31d6bd0c8d04f871d70
- MD5 SHA1 SHA512
- Path /run/.locker.pid.tmp
- Size 3B
- SHA256 313c938e0103b56b43632b702e3e63447fab1f90a4fe890ca5abb7a6cf8830ee
- MD5 81e74d678581a3bb7a720b019f4f1a93
- SHA1 872a319ee7a24a0ea855777702e15aae09deb042
- SHA512 f2b8a36dacc4be1cb01669f4b4b748c8ee2249027a35493782019fe7a61a2792e1c603f45e4521cf5cefc83a16499181b2f1300a2677d765efa4149f58c7a575
- MD5 SHA1 SHA512