Overview

overview

7

Static

static

1

dlr.mips

debian-9-mips

7

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    07/09/2026, 00:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dlr.mips
  • Size 2KB
  • Sample260907-al25fadh63
  • SHA256 bb4914256a8f134337bc2a62cac61e3458f3c16094187d50d6907584b16672b6
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Traces itself 1 IoCs

    Traces itself to prevent debugging attempts

  • Unexpected DNS network traffic destination 54 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job 1 TTPs 5 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 7 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Deletes log files 1 TTPs 1 IoCs

    Deletes log files on the system.

    defense_evasion
  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 2 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Write file to user bin folder 4 IoCs
    persistence
  • Writes file to system bin folder 1 IoCs
  • Modifies Bash startup script 2 TTPs 6 IoCs
    persistence
  • Changes its process name 4 IoCs
  • Creates a desktop entry file 3 TTPs 1 IoCs

    A .desktop file is used by desktop environments to register and launch applications. This can be abused to gain persistence.

    persistenceexecution
  • Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 20 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to shm directory 2 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 7 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/dlr.mips
    /tmp/dlr.mips
    1⤵
    • Executes dropped EXE
    • System Network Configuration Discovery
    • Writes file to tmp directory
    PID:715
  • /tmp/.a2b1d5g2e5t8vc
    .a2b1d5g2e5t8vc
    1⤵
    • Executes dropped EXE
    • Traces itself
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Deletes log files
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Write file to user bin folder
    • Writes file to system bin folder
    • Modifies Bash startup script
    • Changes its process name
    • Creates a desktop entry file
    • Reads runtime system information
    • Writes file to shm directory
    • Writes file to tmp directory
    PID:729
    • /systemctl
      systemctl daemon-reload
      2⤵
        PID:737
      • /bin/systemctl
        systemctl daemon-reload
        2⤵
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:737
      • /systemctl
        systemctl enable network-dispatch.service
        2⤵
          PID:761
        • /bin/systemctl
          systemctl enable network-dispatch.service
          2⤵
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:761
        • /systemctl
          systemctl enable network-dispatch.timer
          2⤵
            PID:774
          • /bin/systemctl
            systemctl enable network-dispatch.timer
            2⤵
            • Enumerates kernel/hardware configuration
            • Reads runtime system information
            PID:774
          • /systemctl
            systemctl enable network-dispatch.path
            2⤵
              PID:787
            • /bin/systemctl
              systemctl enable network-dispatch.path
              2⤵
              • Enumerates kernel/hardware configuration
              • Reads runtime system information
              PID:787
            • /nvram
              nvram set "rc_startup=/etc/init.d/network-dispatch start"
              2⤵
                PID:808
              • /bin/nvram
                nvram set "rc_startup=/etc/init.d/network-dispatch start"
                2⤵
                  PID:808
                • /usr/bin/nvram
                  nvram set "rc_startup=/etc/init.d/network-dispatch start"
                  2⤵
                    PID:808
                  • /nvram
                    nvram set "rc_service=/usr/local/bin/network-dispatch &"
                    2⤵
                      PID:821
                    • /bin/nvram
                      nvram set "rc_service=/usr/local/bin/network-dispatch &"
                      2⤵
                        PID:821
                      • /usr/bin/nvram
                        nvram set "rc_service=/usr/local/bin/network-dispatch &"
                        2⤵
                          PID:821
                        • /nvram
                          nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                          2⤵
                            PID:833
                          • /bin/nvram
                            nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                            2⤵
                              PID:833
                            • /usr/bin/nvram
                              nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                              2⤵
                                PID:833
                              • /nvram
                                nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                2⤵
                                  PID:847
                                • /bin/nvram
                                  nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                  2⤵
                                    PID:847
                                  • /usr/bin/nvram
                                    nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                    2⤵
                                      PID:847
                                    • /nvram
                                      nvram commit
                                      2⤵
                                        PID:849
                                      • /bin/nvram
                                        nvram commit
                                        2⤵
                                          PID:849
                                        • /usr/bin/nvram
                                          nvram commit
                                          2⤵
                                            PID:849
                                          • /fw_printenv
                                            fw_printenv bootcmd
                                            2⤵
                                              PID:850
                                            • /bin/fw_printenv
                                              fw_printenv bootcmd
                                              2⤵
                                                PID:850
                                              • /usr/bin/fw_printenv
                                                fw_printenv bootcmd
                                                2⤵
                                                  PID:850
                                                • /fw_setenv
                                                  fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
                                                  2⤵
                                                    PID:851
                                                  • /bin/fw_setenv
                                                    fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
                                                    2⤵
                                                      PID:851
                                                    • /usr/bin/fw_setenv
                                                      fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
                                                      2⤵
                                                        PID:851
                                                      • /etc/init.d/network-dispatch
                                                        /etc/init.d/network-dispatch enable
                                                        2⤵
                                                          PID:852
                                                        • /rc-update
                                                          rc-update add network-dispatch
                                                          2⤵
                                                            PID:853
                                                          • /bin/rc-update
                                                            rc-update add network-dispatch
                                                            2⤵
                                                              PID:853
                                                            • /usr/bin/rc-update
                                                              rc-update add network-dispatch
                                                              2⤵
                                                                PID:853

                                                            Network

                                                                  MITRE ATT&CK Enterprise v16

                                                                  Reconnaissance

                                                                  Resource Development

                                                                  Initial Access

                                                                  Execution

                                                                  Scheduled Task/Job

                                                                  1
                                                                  T1053

                                                                  Cron

                                                                  1
                                                                  T1053.003

                                                                  User Execution

                                                                  2
                                                                  T1204

                                                                  Malicious File

                                                                  1
                                                                  T1204.002

                                                                  Persistence

                                                                  Boot or Logon Autostart Execution

                                                                  5
                                                                  T1547

                                                                  XDG Autostart Entries

                                                                  2
                                                                  T1547.013

                                                                  Boot or Logon Initialization Scripts

                                                                  2
                                                                  T1037

                                                                  RC Scripts

                                                                  2
                                                                  T1037.004

                                                                  Create or Modify System Process

                                                                  1
                                                                  T1543

                                                                  Systemd Service

                                                                  1
                                                                  T1543.002

                                                                  Event Triggered Execution

                                                                  1
                                                                  T1546

                                                                  Unix Shell Configuration Modification

                                                                  1
                                                                  T1546.004

                                                                  Hijack Execution Flow

                                                                  1
                                                                  T1574

                                                                  Path Interception by PATH Environment Variable

                                                                  1
                                                                  T1574.007

                                                                  Scheduled Task/Job

                                                                  1
                                                                  T1053

                                                                  Cron

                                                                  1
                                                                  T1053.003

                                                                  Privilege Escalation

                                                                  Boot or Logon Autostart Execution

                                                                  5
                                                                  T1547

                                                                  XDG Autostart Entries

                                                                  2
                                                                  T1547.013

                                                                  Boot or Logon Initialization Scripts

                                                                  2
                                                                  T1037

                                                                  RC Scripts

                                                                  2
                                                                  T1037.004

                                                                  Create or Modify System Process

                                                                  1
                                                                  T1543

                                                                  Systemd Service

                                                                  1
                                                                  T1543.002

                                                                  Event Triggered Execution

                                                                  1
                                                                  T1546

                                                                  Unix Shell Configuration Modification

                                                                  1
                                                                  T1546.004

                                                                  Hijack Execution Flow

                                                                  1
                                                                  T1574

                                                                  Path Interception by PATH Environment Variable

                                                                  1
                                                                  T1574.007

                                                                  Scheduled Task/Job

                                                                  1
                                                                  T1053

                                                                  Cron

                                                                  1
                                                                  T1053.003

                                                                  Defense Evasion

                                                                  Hijack Execution Flow

                                                                  1
                                                                  T1574

                                                                  Path Interception by PATH Environment Variable

                                                                  1
                                                                  T1574.007

                                                                  Indicator Removal

                                                                  1
                                                                  T1070

                                                                  Clear Linux or Mac System Logs

                                                                  1
                                                                  T1070.002

                                                                  Credential Access

                                                                  Discovery

                                                                  System Information Discovery

                                                                  1
                                                                  T1082

                                                                  System Network Configuration Discovery

                                                                  1
                                                                  T1016

                                                                  Lateral Movement

                                                                  Collection

                                                                  Command and Control

                                                                  Exfiltration

                                                                  Impact

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  .network-dispatch
                                                                  • Path /dev/mqueue/.network-dispatch
                                                                  • Size 4KB
                                                                  • SHA256 67560a3f97b6fa241e33941ad15845acb04b6090f6cb5da2b04a260cb6f1fadf
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  99-net
                                                                  • Path /etc/NetworkManager/dispatcher.d/99-net
                                                                  • Size 210B
                                                                  • SHA256 776d1761eae08b8cfc6e2a8e8699b9f4d03612652dccdce1945faeb689bfeafb
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  99-net
                                                                  • Path /etc/apt/apt.conf.d/99-net
                                                                  • Size 106B
                                                                  • SHA256 1b1231ac2da301495d86a53afc51256f9bb669db34eb313681f4d6f6c3999fff
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  network-dispatch
                                                                  • Path /etc/cron.d/network-dispatch
                                                                  • Size 36B
                                                                  • SHA256 ec42901c64210c14565c07897d139d3a710bd78a73b5cdca2bcd9312ffe6a00a
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  network-dispatch
                                                                  • Path /etc/cron.hourly/network-dispatch
                                                                  • Size 153B
                                                                  • SHA256 e697cfb597843583c2ba1fead9bb44cd19a77964d1d80e4b5a654cf5b7716049
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  net
                                                                  • Path /etc/dhcp/dhclient-exit-hooks.d/net
                                                                  • Size 155B
                                                                  • SHA256 060d71aff2e29495b1504502181fcafc057a357e1eea08bcf577139fb856eda7
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  network-dispatch
                                                                  • Path /etc/dinit.d/network-dispatch
                                                                  • Size 113B
                                                                  • SHA256 4b7155af80fe3e49f510c8f6eae1ece9fe0e8ef049a0f03e3e6541e4279dc094
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  inetd.conf
                                                                  • Path /etc/inetd.conf
                                                                  • Size 94B
                                                                  • SHA256 57fae5c95bbd8f5a4d0b1bb7a8dbc013da6af6719109b42e76fcd76c78714e91
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  network-dispatch
                                                                  • Path /etc/init.d/network-dispatch
                                                                  • Size 274B
                                                                  • SHA256 789ca44e264ccab23b87f19a7caad559621c915965f2c5c79b7750a77fd03e68
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  network-dispatch
                                                                  • Path /etc/init.d/network-dispatch
                                                                  • Size 212B
                                                                  • SHA256 0a37c1a8d049918041b5ce44091ff75ff30399afde95f3ed5f3d1c4f9ae6340d
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  network-dispatch
                                                                  • Path /etc/init.d/network-dispatch
                                                                  • Size 162B
                                                                  • SHA256 b4b2f8b02d369f1e66c96ed4f829ad1ce9338ef5e0b34c3e9de4943fe97fcd2a
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  inittab
                                                                  • Path /etc/inittab
                                                                  • Size 43B
                                                                  • SHA256 da40a0f49a0445ccce643f0bdd1b0d7a973887049de319715e42b05b14e4c1a3
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  network-dispatch.start
                                                                  • Path /etc/local.d/network-dispatch.start
                                                                  • Size 88B
                                                                  • SHA256 6c9c89370a346bffd0fb49fbacd5e6cc0419ccbea43fe3640494dc9163fb3f86
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  keeprc.conf
                                                                  • Path /etc/opkg/keeprc.conf
                                                                  • Size 54B
                                                                  • SHA256 7cf39b594679820bedec1cbb2aca992ae9e02106ae2e2b7db2036355e6644c0d
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  00-net.sh
                                                                  • Path /etc/profile.d/00-net.sh
                                                                  • Size 104B
                                                                  • SHA256 f48aa622f48b7b1d21ae011bbd029444bbe64d3db4455583c1502ab3234f8237
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  network-dispatch-gen
                                                                  • Path /etc/systemd/system-generators/network-dispatch-gen
                                                                  • Size 387B
                                                                  • SHA256 8ba6bf8e42767ace35afdc90bcdeeec40343e05a662c1b1d21217190806ec325
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  network-dispatch.service
                                                                  • Path /etc/systemd/system/network-dispatch.service
                                                                  • Size 228B
                                                                  • SHA256 f0a4522d9cacf37bc711ef07c7a07d2627ac3fb2a25e13e1695db14896da415e
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  99-network-dispatch.rules
                                                                  • Path /etc/udev/rules.d/99-network-dispatch.rules
                                                                  • Size 144B
                                                                  • SHA256 42a9eef129fbeeaca0319f9309d96f1395b8fb80f3b50bec77550acf10d4b376
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  network-dispatch.desktop
                                                                  • Path /etc/xdg/autostart/network-dispatch.desktop
                                                                  • Size 150B
                                                                  • SHA256 9e4b415925f30fa0dc525855d2269f7a90d712714ba5ec64b4cdd9e628a517b6
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  .bash_profile
                                                                  • Path /root/.bash_profile
                                                                  • Size 95B
                                                                  • SHA256 e89e5301a59ce3fb142a5e91407aa628339ca08123fb850acfea056ee059db91
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  network-dispatch.service
                                                                  • Path /root/.config/systemd/user/network-dispatch.service
                                                                  • Size 152B
                                                                  • SHA256 8493e90ac274688355fba972b6898b69fa003b1c742ad77b026a3518fbbea18d
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  .a2b1d5g2e5t8vc
                                                                  • Path /tmp/.a2b1d5g2e5t8vc
                                                                  • Size 504KB
                                                                  • SHA256 2bdcd6e8a368c28488926a4773bf4cc2d5840ced8cb6499e417c3743cec7c44c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  watchdog-net
                                                                  • Path /usr/local/bin/watchdog-net
                                                                  • Size 186B
                                                                  • SHA256 39524eda228aa5586b775c3fa9b2b3a5b4e114ae0cf1e3f284fb5d0a2a87a8e5
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  root
                                                                  • Path /var/spool/cron/crontabs/root
                                                                  • Size 126B
                                                                  • SHA256 84512cb49c634de2560f05a51fd68808c610dd6af6c4adccb5e5b022f1006e7a
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download