Analysis
- max time kernel
4s - max time network
5s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
03/10/2026, 12:19
Behavioral task
behavioral1
Sample
mips
Resource
debian9-mipsbe-20260513-en
debian-9-mips
5 signatures
150 seconds
General
- Target mips
- Size 70KB
- Sample261003-phlevazvct
- SHA256 9516e8ee57bc4a9c35deaf1906b051661e97e17fea0d49e0fe7cebb431790f7c
- MD5 1bcacdbda6cdb2865d0e8351e441549c
- SHA1 c242edfa80285b22eabe3f8f83440cf95d1f5776
- SHA512 e2fbde97851a79b1f496952ce87284dea788006e2e37b2a79bf46ca4a3952396fc78d612283900e04e0acdab2f46f05863b626263403254afa295f64ae74dcf1
- SSDEEP 768:bPWek0n4CjdGQKKWxmg0EhFkFkeYA+Qo+xXyApGqFDjOZ2uyyQ5NeNTP4wncIZ:bj/hSmmjAo+Jym2Uu6eBPZncq
- TLSH T1AC63B61A6E628FBDFB59833447B78E21AB5833D527D1D641E25CD6002F6034E681FFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 698 mips - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 7 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself bash 699 mips Changes the process name, possibly in an attempt to hide itself nginx 700 mips Changes the process name, possibly in an attempt to hide itself inetd 701 mips Changes the process name, possibly in an attempt to hide itself sshd 702 mips Changes the process name, possibly in an attempt to hide itself bash 701 mips Changes the process name, possibly in an attempt to hide itself inetd 729 mips Changes the process name, possibly in an attempt to hide itself sshd 730 mips -
description ioc Process File opened for reading /proc/667/cmdline mips File opened for reading /proc/11/cmdline mips File opened for reading /proc/22/cmdline mips File opened for reading /proc/68/cmdline mips File opened for reading /proc/109/cmdline mips File opened for reading /proc/693/cmdline mips File opened for reading /proc/2/cmdline mips File opened for reading /proc/16/cmdline mips File opened for reading /proc/36/cmdline mips File opened for reading /proc/71/cmdline mips File opened for reading /proc/386/cmdline mips File opened for reading /proc/338/cmdline mips File opened for reading /proc/697/cmdline mips File opened for reading /proc/23/cmdline mips File opened for reading /proc/248/cmdline mips File opened for reading /proc/696/cmdline mips File opened for reading /proc/701/cmdline mips File opened for reading /proc/19/cmdline mips File opened for reading /proc/77/cmdline mips File opened for reading /proc/702/cmdline mips File opened for reading /proc/18/cmdline mips File opened for reading /proc/388/cmdline mips File opened for reading /proc/660/cmdline mips File opened for reading /proc/5/cmdline mips File opened for reading /proc/9/cmdline mips File opened for reading /proc/79/cmdline mips File opened for reading /proc/123/cmdline mips File opened for reading /proc/152/cmdline mips File opened for reading /proc/337/cmdline mips File opened for reading /proc/657/cmdline mips File opened for reading /proc/688/cmdline mips File opened for reading /proc/380/cmdline mips File opened for reading /proc/645/cmdline mips File opened for reading /proc/6/cmdline mips File opened for reading /proc/72/cmdline mips File opened for reading /proc/690/cmdline mips File opened for reading /proc/695/cmdline mips File opened for reading /proc/13/cmdline mips File opened for reading /proc/69/cmdline mips File opened for reading /proc/82/cmdline mips File opened for reading /proc/158/cmdline mips File opened for reading /proc/173/cmdline mips File opened for reading /proc/666/cmdline mips File opened for reading /proc/4/cmdline mips File opened for reading /proc/8/cmdline mips File opened for reading /proc/235/cmdline mips File opened for reading /proc/394/cmdline mips File opened for reading /proc/703/cmdline mips File opened for reading /proc/20/cmdline mips File opened for reading /proc/24/cmdline mips File opened for reading /proc/80/cmdline mips File opened for reading /proc/342/cmdline mips File opened for reading /proc/346/cmdline mips File opened for reading /proc/10/cmdline mips File opened for reading /proc/339/cmdline mips File opened for reading /proc/3/cmdline mips File opened for reading /proc/15/cmdline mips File opened for reading /proc/17/cmdline mips File opened for reading /proc/21/cmdline mips File opened for reading /proc/76/cmdline mips File opened for reading /proc/14/cmdline mips File opened for reading /proc/67/cmdline mips File opened for reading /proc/70/cmdline mips File opened for reading /proc/344/cmdline mips - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 698 mips