Analysis
- max time kernel
148s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
10/09/2026, 18:45
Behavioral task
behavioral1
Sample
7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487
Resource
debian9-mipsbe-20260513-en
debian-9-mips
4 signatures
150 seconds
General
- Target 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487
- Size 75KB
- Sample260910-xd9wmsw1ft
- SHA256 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487
- MD5 f1ae183a6e447c0dc0fb797284ec7f4b
- SHA1 1ae1fa14fe05458a994ec1fc7be41d0354bbc9f6
- SHA512 4c2c37a445c5451a533408e4296b0932cab07b7294e0d1ec14725794696fbdb5c4de59ad25069bd61361d55096d8d4b8d35641d36da38562d41ca3f7f89cefdc
- SSDEEP 1536:Zn0viuxKC3Oa3yqreEHAhKEPbKiCmScj9wnJlEMTZD44xTWgh5XOVJuP:1OiM3Oa3yme/0EPbKiCCmJGI+DghoVQP
- TLSH T1C373024059100BA7E81B80B691BC8BA17F651D73526468D9B36BB7F98CE40B43DA7FB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 708 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself orimhhh 708 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 -
description ioc Process File opened for reading /proc/341/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/698/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/779/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/4/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/20/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/70/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/659/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/704/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/1/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/72/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/153/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/12/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/36/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/176/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/235/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/248/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/394/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/662/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/666/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/17/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/37/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/336/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/388/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/646/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/701/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/self/status 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/3/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/709/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/73/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/344/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/693/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/15/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/23/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/125/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/126/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/335/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/665/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/21/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/702/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/767/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/2/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/13/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/382/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/780/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/10/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/11/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/14/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/77/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/81/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/16/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/22/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/76/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/9/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/18/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/19/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/24/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/82/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/109/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/691/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/387/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/710/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/7/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/71/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487 File opened for reading /proc/74/comm 7f2c8b6661f093cc6932c1c34df5fa78bb2390ef1e73195550201b92dfdbd487