Analysis
- max time kernel
124s - max time network
157s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
05/10/2026, 17:25
Static task
static1
General
- Target mipsel.elf
- Size 328KB
- Sample261005-vzhyyaydpc
- SHA256 a9d02f241e146bc98805dc1a4d15d98c8ec178e4dc3f0d263322e1dea580c44c
- MD5 9a4d6d39eb0e720b632fcb633bdc8b33
- SHA1 44eb89e06676b40e924bdd10e1f73c5d328e3317
- SHA512 a3aa4a96686f32b13f160bb65df42b4839aa8f780a86d3c589abc561e3ef21bec8e2da3b1acd548fe5822171fdb370f6a8d5ed398e4efa6e43a8c95cc64cfcac
- SSDEEP 3072:hMUyh2KxMKeOBaGniirwMuLu+lwxDxwUY3qZCpUpc5ZIccYi7g2+HxIW:stWOBr/rnyu+lMgQc5ZuDg2qI
- TLSH T1336409066B218FFBD85FDD3306F6871518CCB84326A93B7A7270DA5CB90668B49D3874
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contacts a large (178122) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/class/dmi/id/product_name mipsel.elf - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp mipsel.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/lib/boltd/boltd 796 mipsel.elf - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp mipsel.elf -
description ioc Process File opened for reading /proc/930/comm mipsel.elf File opened for reading /proc/24/comm mipsel.elf File opened for reading /proc/42/cmdline mipsel.elf File opened for reading /proc/327/cmdline mipsel.elf File opened for reading /proc/761/status mipsel.elf File opened for reading /proc/767/status mipsel.elf File opened for reading /proc/787/cmdline mipsel.elf File opened for reading /proc/47/comm mipsel.elf File opened for reading /proc/112/comm mipsel.elf File opened for reading /proc/3/cmdline mipsel.elf File opened for reading /proc/5/comm mipsel.elf File opened for reading /proc/14/cmdline mipsel.elf File opened for reading /proc/181/comm mipsel.elf File opened for reading /proc/346/comm mipsel.elf File opened for reading /proc/708/cmdline mipsel.elf File opened for reading /proc/777/comm mipsel.elf File opened for reading /proc/801/cmdline mipsel.elf File opened for reading /proc/7/cmdline mipsel.elf File opened for reading /proc/31/cmdline mipsel.elf File opened for reading /proc/137/comm mipsel.elf File opened for reading /proc/930/cmdline mipsel.elf File opened for reading /proc/35/cmdline mipsel.elf File opened for reading /proc/115/comm mipsel.elf File opened for reading /proc/327/status mipsel.elf File opened for reading /proc/708/comm mipsel.elf File opened for reading /proc/772/cmdline mipsel.elf File opened for reading /proc/796/cmdline mipsel.elf File opened for reading /proc/12/comm mipsel.elf File opened for reading /proc/20/cmdline mipsel.elf File opened for reading /proc/37/comm mipsel.elf File opened for reading /proc/59/cmdline mipsel.elf File opened for reading /proc/59/comm mipsel.elf File opened for reading /proc/138/comm mipsel.elf File opened for reading /proc/346/cmdline mipsel.elf File opened for reading /proc/678/cmdline mipsel.elf File opened for reading /proc/5/cmdline mipsel.elf File opened for reading /proc/11/comm mipsel.elf File opened for reading /proc/48/cmdline mipsel.elf File opened for reading /proc/58/comm mipsel.elf File opened for reading /proc/6/comm mipsel.elf File opened for reading /proc/16/comm mipsel.elf File opened for reading /proc/17/cmdline mipsel.elf File opened for reading /proc/19/cmdline mipsel.elf File opened for reading /proc/23/cmdline mipsel.elf File opened for reading /proc/29/comm mipsel.elf File opened for reading /proc/18/cmdline mipsel.elf File opened for reading /proc/26/comm mipsel.elf File opened for reading /proc/112/cmdline mipsel.elf File opened for reading /proc/408/cmdline mipsel.elf File opened for reading /proc/801/comm mipsel.elf File opened for reading /proc/33/comm mipsel.elf File opened for reading /proc/119/comm mipsel.elf File opened for reading /proc/390/cmdline mipsel.elf File opened for reading /proc/410/status mipsel.elf File opened for reading /proc/4/cmdline mipsel.elf File opened for reading /proc/19/comm mipsel.elf File opened for reading /proc/23/comm mipsel.elf File opened for reading /proc/113/cmdline mipsel.elf File opened for reading /proc/138/cmdline mipsel.elf File opened for reading /proc/380/cmdline mipsel.elf File opened for reading /proc/395/comm mipsel.elf File opened for reading /proc/9/cmdline mipsel.elf File opened for reading /proc/9/comm mipsel.elf File opened for reading /proc/27/comm mipsel.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 794 mipsel.elf