Analysis
- max time kernel
151s - max time network
156s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
- submitted
24/09/2026, 10:57
General
- Target ooikocqj.mips64.elf
- Size 1.0MB
- Sample260924-m2d4rssgkh
- SHA256 8b6285d539d848f255ac58cc2edcaa3aaf43d5abd36ea27562299574765e3d77
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads MAC address of network interface 2 TTPs 2 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 64 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/ooikocqj.mips64.elf/tmp/ooikocqj.mips64.elf1⤵
- Checks hardware identifiers (DMI)
- Reads MAC address of network interface
- Checks CPU configuration
- Enumerates kernel/hardware configuration
- System Network Configuration Discovery
- Writes file to tmp directory
-
/bin/shsh -c -- "cp /proc/self/exe /var/.z 2>/dev/null && chmod +x /var/.z 2>/dev/null"2⤵
- File and Directory Permissions Modification
-
/usr/bin/cpcp /proc/self/exe /var/.z3⤵
-
-
/usr/bin/chmodchmod +x /var/.z3⤵
- File and Directory Permissions Modification
-
-
-
/bin/shsh -c -- "pkill -9 -x kavsvc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x kavf4 2>/dev/null &"2⤵
-
/usr/bin/pkillpkill -9 -x kavf43⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
-
-
/bin/shsh -c -- "pkill -9 -x kavguard 2>/dev/null &"2⤵
-
/usr/bin/pkillpkill -9 -x kavguard3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
-
/bin/shsh -c -- "pkill -9 -x avp 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp5 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp6 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msvsc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msasc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msmpeng 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msseces 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x msseces.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast5 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avast6 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avastsvc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ash 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x ashmaisv 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avgnt3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamd 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamdscan 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x clamonacc 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-prot 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-prot64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-sport 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x f-sport64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x smon3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs2 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x mcs3 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navpsv32 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navpsv64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navw32 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x navw64 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpsvc.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpcc.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avpm.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp9.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp10.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp11.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp12.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp13.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp14.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp15.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp16.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp17.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp18.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp19.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp20.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp21.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp22.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp23.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp24.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp25.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp26.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp27.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp28.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp29.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp30.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp31.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp32.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp33.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp34.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp35.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp36.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp37.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp38.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp39.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp40.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp41.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp42.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp43.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp44.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp45.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp46.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp47.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp48.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp49.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -x avp50.exe 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]alcond 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [f]alcon 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]sagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]rowdstrike 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]entinelagent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]entinelhelper 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]1-agent 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [s]1-service 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [x]agt 2>/dev/null &"2⤵
-
-
/bin/shsh -c -- "pkill -9 -f [c]bdefense 2>/dev/null &"2⤵
-
-
/usr/bin/pkillpkill -9 -x kavsvc1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp51⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp61⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x msvsc1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x msasc1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x msmpeng1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x msseces1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x msseces.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avast1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avast51⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avast61⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avastsvc1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x ash1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x ashmaisv1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avgnt1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avgnt.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avgnt21⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avgnt31⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x clamd1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x clamdscan1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x clamonacc1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x f-prot1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x f-prot641⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x f-sport1⤵
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x f-sport641⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x smon1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x smon21⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x smon31⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x mcs1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x mcs21⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x mcs31⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x navpsv321⤵
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x navpsv641⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x navw321⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x navw641⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp.exe1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avpsvc.exe1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avpcc.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avpm.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp9.exe1⤵
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp10.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp11.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp12.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp13.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp14.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp15.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp16.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp17.exe1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp18.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp19.exe1⤵
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp20.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp21.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp22.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp23.exe1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp24.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp25.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp26.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp27.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp28.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp29.exe1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp30.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp31.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp32.exe1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp33.exe1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp34.exe1⤵
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp35.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp36.exe1⤵
-
/usr/bin/pkillpkill -9 -x avp37.exe1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp38.exe1⤵
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp39.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp40.exe1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp41.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp42.exe1⤵
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp43.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp44.exe1⤵
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp45.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp46.exe1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -x avp47.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp48.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -x avp49.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -x avp50.exe1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -f "[f]alcond"1⤵
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -f "[f]alcon"1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/pkillpkill -9 -f "[c]sagent"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[c]rowdstrike"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[s]entinelagent"1⤵
- Reads CPU attributes
-
/usr/bin/pkillpkill -9 -f "[s]entinelhelper"1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/pkillpkill -9 -f "[s]1-agent"1⤵
-
/usr/bin/pkillpkill -9 -f "[s]1-service"1⤵
-
/usr/bin/pkillpkill -9 -f "[x]agt"1⤵
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
2System Checks
2