Analysis
- user interaction
yes - max time kernel
123s - max time network
151s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
03/09/2026, 18:18
Static task
static1
Behavioral task
behavioral1
Sample
3896472.bin
Resource
debian9-mipsbe-20260513-en
debian-9-mips
7 signatures
150 seconds
General
- Target 3896472.bin
- Size 139KB
- Sample260903-wxsk2adm21
- SHA256 dd55efc4766c21d6a1a974a8636f7174353e10b8367fec0021d7a364a0d2f64e
- MD5 424c61ddd84544219d9c743121903a07
- SHA1 31e06f8f7fd69c8cf60e39bfd6c479eaff4a005a
- SHA512 9b6316bf8fb65960f3342459afed20350ab4cf7eac75df708f3b7d5395b933294b486f97e24bea105df79058d37b9df64b1aaa7c722ed4d8126a4d667265633f
- SSDEEP 3072:YCXPgmH01jehCsNMv0bba5hMgAHkkc73C8u/26U4ch:YC/gukvlKN4
- TLSH T10EE3E81FBE619F6CF7A883350BF74E34A29927C627D1C546D26CE2101E6028E645FFA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Renames itself 1 IoCs
pid Process 717 3896472.bin - Enumerates running processes
Discovers information about currently running processes on the system
- Reads MAC address of network interface 2 TTPs 1 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
description ioc Process File opened for reading /sys/class/net/enp0s19/address 3896472.bin - Reads network interface configuration 2 TTPs 2 IoCs
Fetches information about one or more active network interfaces.
description ioc Process File opened for reading /sys/class/net/enp0s19/flags 3896472.bin File opened for reading /sys/class/net/enp0s19/carrier 3896472.bin - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself udhcpc 717 3896472.bin - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/class/net 3896472.bin -
description ioc Process File opened for reading /proc/830/cmdline 3896472.bin File opened for reading /proc/750/cmdline 3896472.bin File opened for reading /proc/836/cmdline 3896472.bin File opened for reading /proc/13/cmdline 3896472.bin File opened for reading /proc/162/cmdline 3896472.bin File opened for reading /proc/772/cmdline 3896472.bin File opened for reading /proc/4/exe 3896472.bin File opened for reading /proc/10/exe 3896472.bin File opened for reading /proc/6/cmdline 3896472.bin File opened for reading /proc/15/cmdline 3896472.bin File opened for reading /proc/16/cmdline 3896472.bin File opened for reading /proc/79/cmdline 3896472.bin File opened for reading /proc/126/cmdline 3896472.bin File opened for reading /proc/675/cmdline 3896472.bin File opened for reading /proc/330/cmdline 3896472.bin File opened for reading /proc/720/cmdline 3896472.bin File opened for reading /proc/738/cmdline 3896472.bin File opened for reading /proc/741/cmdline 3896472.bin File opened for reading /proc/779/cmdline 3896472.bin File opened for reading /proc/806/cmdline 3896472.bin File opened for reading /proc/808/cmdline 3896472.bin File opened for reading /proc/8/cmdline 3896472.bin File opened for reading /proc/736/cmdline 3896472.bin File opened for reading /proc/751/cmdline 3896472.bin File opened for reading /proc/803/cmdline 3896472.bin File opened for reading /proc/822/cmdline 3896472.bin File opened for reading /proc/844/cmdline 3896472.bin File opened for reading /proc/756/cmdline 3896472.bin File opened for reading /proc/12/cmdline 3896472.bin File opened for reading /proc/80/cmdline 3896472.bin File opened for reading /proc/769/cmdline 3896472.bin File opened for reading /proc/826/cmdline 3896472.bin File opened for reading /proc/828/cmdline 3896472.bin File opened for reading /proc/842/cmdline 3896472.bin File opened for reading /proc/762/cmdline 3896472.bin File opened for reading /proc/20/cmdline 3896472.bin File opened for reading /proc/21/cmdline 3896472.bin File opened for reading /proc/739/cmdline 3896472.bin File opened for reading /proc/771/cmdline 3896472.bin File opened for reading /proc/817/cmdline 3896472.bin File opened for reading /proc/8/exe 3896472.bin File opened for reading /proc/37/cmdline 3896472.bin File opened for reading /proc/662/cmdline 3896472.bin File opened for reading /proc/753/cmdline 3896472.bin File opened for reading /proc/790/cmdline 3896472.bin File opened for reading /proc/827/cmdline 3896472.bin File opened for reading /proc/329/cmdline 3896472.bin File opened for reading /proc/723/cmdline 3896472.bin File opened for reading /proc/764/cmdline 3896472.bin File opened for reading /proc/746/cmdline 3896472.bin File opened for reading /proc/837/cmdline 3896472.bin File opened for reading /proc/3/exe 3896472.bin File opened for reading /proc/7/cmdline 3896472.bin File opened for reading /proc/332/cmdline 3896472.bin File opened for reading /proc/714/cmdline 3896472.bin File opened for reading /proc/715/cmdline 3896472.bin File opened for reading /proc/740/cmdline 3896472.bin File opened for reading /proc/745/cmdline 3896472.bin File opened for reading /proc/748/cmdline 3896472.bin File opened for reading /proc/23/cmdline 3896472.bin File opened for reading /proc/244/cmdline 3896472.bin File opened for reading /proc/759/cmdline 3896472.bin File opened for reading /proc/800/cmdline 3896472.bin File opened for reading /proc/13/exe 3896472.bin