Analysis
- max time kernel
88s - max time network
118s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
10/09/2026, 00:21
Static task
static1
Behavioral task
behavioral1
Sample
iran.mipsrouter
Resource
debian9-mipsbe-20260513-en
debian-9-mips
5 signatures
150 seconds
General
- Target iran.mipsrouter
- Size 240KB
- Sample260910-anfdfssgkf
- SHA256 1bcf52ca1c3638e76d59ffb879cdc673f990743459243954e54af84e3ada6a96
- MD5 0e51f21907ee112c8d5274c2cf63cf83
- SHA1 568560c0714fece29a9203f5b4b56d8430582e6c
- SHA512 094062a20eb83955b5bd30d0e82c4b4f4a68528525014659bca5e292ece437fcf92d4846001b99b845a1ccd2fb51624343a8b22d86bc13feb60835e58db10749
- SSDEEP 6144:pjn4F842iQbY1dplvtKWf1p1J8JG8WYkQsxNenndQ:iF84s+Ff1p1J8JG8WYkQsxNenndQ
- TLSH T16334B91A3E228FBEF268C77047F34A31976976D627E2D684E26CD5101F1438D681FB68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/xs.main iran.mipsrouter - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself -sh 714 iran.mipsrouter -
description ioc Process File opened for reading /proc/24/comm iran.mipsrouter File opened for reading /proc/80/comm iran.mipsrouter File opened for reading /proc/151/comm iran.mipsrouter File opened for reading /proc/368/comm iran.mipsrouter File opened for reading /proc/2/comm iran.mipsrouter File opened for reading /proc/10/comm iran.mipsrouter File opened for reading /proc/13/comm iran.mipsrouter File opened for reading /proc/16/comm iran.mipsrouter File opened for reading /proc/23/comm iran.mipsrouter File opened for reading /proc/75/comm iran.mipsrouter File opened for reading /proc/243/comm iran.mipsrouter File opened for reading /proc/338/comm iran.mipsrouter File opened for reading /proc/3/comm iran.mipsrouter File opened for reading /proc/9/comm iran.mipsrouter File opened for reading /proc/37/comm iran.mipsrouter File opened for reading /proc/158/comm iran.mipsrouter File opened for reading /proc/386/comm iran.mipsrouter File opened for reading /proc/6/comm iran.mipsrouter File opened for reading /proc/12/comm iran.mipsrouter File opened for reading /proc/333/comm iran.mipsrouter File opened for reading /proc/380/comm iran.mipsrouter File opened for reading /proc/703/comm iran.mipsrouter File opened for reading /proc/4/comm iran.mipsrouter File opened for reading /proc/73/comm iran.mipsrouter File opened for reading /proc/109/comm iran.mipsrouter File opened for reading /proc/335/comm iran.mipsrouter File opened for reading /proc/11/comm iran.mipsrouter File opened for reading /proc/381/comm iran.mipsrouter File opened for reading /proc/708/comm iran.mipsrouter File opened for reading /proc/709/comm iran.mipsrouter File opened for reading /proc/36/comm iran.mipsrouter File opened for reading /proc/8/comm iran.mipsrouter File opened for reading /proc/18/comm iran.mipsrouter File opened for reading /proc/124/comm iran.mipsrouter File opened for reading /proc/685/comm iran.mipsrouter File opened for reading /proc/7/comm iran.mipsrouter File opened for reading /proc/174/comm iran.mipsrouter File opened for reading /proc/686/comm iran.mipsrouter File opened for reading /proc/711/comm iran.mipsrouter File opened for reading /proc/20/comm iran.mipsrouter File opened for reading /proc/22/comm iran.mipsrouter File opened for reading /proc/74/comm iran.mipsrouter File opened for reading /proc/710/comm iran.mipsrouter File opened for reading /proc/712/comm iran.mipsrouter File opened for reading /proc/69/comm iran.mipsrouter File opened for reading /proc/5/comm iran.mipsrouter File opened for reading /proc/14/comm iran.mipsrouter File opened for reading /proc/15/comm iran.mipsrouter File opened for reading /proc/72/comm iran.mipsrouter File opened for reading /proc/123/comm iran.mipsrouter File opened for reading /proc/331/comm iran.mipsrouter File opened for reading /proc/432/comm iran.mipsrouter File opened for reading /proc/76/comm iran.mipsrouter File opened for reading /proc/78/comm iran.mipsrouter File opened for reading /proc/82/comm iran.mipsrouter File opened for reading /proc/337/comm iran.mipsrouter File opened for reading /proc/676/comm iran.mipsrouter File opened for reading /proc/701/comm iran.mipsrouter File opened for reading /proc/706/comm iran.mipsrouter File opened for reading /proc/71/comm iran.mipsrouter File opened for reading /proc/679/comm iran.mipsrouter File opened for reading /proc/1/comm iran.mipsrouter File opened for reading /proc/77/comm iran.mipsrouter File opened for reading /proc/230/comm iran.mipsrouter - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 711 iran.mipsrouter
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/init.d/xs.main
- Size 32B
- SHA256 03a06cb95363068ef9e2fc6d40a32ede92d892bbbd7aacb3fb5e22fa14c0064d
- MD5 2768fd2e82ad85e99f5271e663a09685
- SHA1 50c21c5a21f31274c63dcc2cc1797ceb70866ad6
- SHA512 2b45e03617afc3c27877fc4df9d9733423cb07fbc5d79bc8d9fa1c6120bbc4b02968129e929bd694f284b5fe769720b19128e19dd38d41b0061d6b378e2b20d2
- MD5 SHA1 SHA512