Analysis
- max time kernel
144s - max time network
150s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
06/10/2026, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
retlfugt5m
Resource
debian9-mipsbe-20260513-en
debian-9-mips
10 signatures
150 seconds
General
- Target retlfugt5m
- Size 176KB
- Sample261006-pg3mqsgt5t
- SHA256 f555bb5cd1f6e651339cc5f408c12c20ce441eb5640b37aef8b46a891c8d8835
- MD5 fb36915b5170d0f1f48e6b55cd0ca70d
- SHA1 f2c3b87a8560107171fcd0d087a9e9a40f254f54
- SHA512 e5c46ebea58bc6b33faf470077ed96153f8f72eb52af486af1fabe064bd5c6482a85c687e83217b283029edcf7b419c86c3ffc527d555426382ecda008e4f9d4
- SSDEEP 3072:kgfKVeEOH4lcgjfAtq2DsleM3p7W8woHHNl3TI1P6/iOUFJi95PrfuJKd8:kbNR1kq2DWbwonXsqi76wId8
- TLSH T1C904F18772018F51C235417209F3C792EBE723E61BC26247A77DD9009B9AB1C991FEE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
description ioc Process File deleted /var/log/audit/audit.log retlfugt5m - Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
description ioc Process File deleted /var/log/syslog retlfugt5m - Traces itself 53 IoCs
Traces itself to prevent debugging attempts
pid Process 720 retlfugt5m 729 retlfugt5m 747 retlfugt5m 753 retlfugt5m 788 retlfugt5m 795 retlfugt5m 814 retlfugt5m 827 retlfugt5m 828 retlfugt5m 829 retlfugt5m 830 retlfugt5m 831 retlfugt5m 835 retlfugt5m 836 retlfugt5m 837 retlfugt5m 838 retlfugt5m 839 retlfugt5m 840 retlfugt5m 841 retlfugt5m 842 retlfugt5m 843 retlfugt5m 844 retlfugt5m 845 retlfugt5m 846 retlfugt5m 847 retlfugt5m 848 retlfugt5m 849 retlfugt5m 850 retlfugt5m 851 retlfugt5m 852 retlfugt5m 853 retlfugt5m 854 retlfugt5m 855 retlfugt5m 856 retlfugt5m 857 retlfugt5m 858 retlfugt5m 859 retlfugt5m 860 retlfugt5m 861 retlfugt5m 862 retlfugt5m 863 retlfugt5m 864 retlfugt5m 865 retlfugt5m 866 retlfugt5m 867 retlfugt5m 868 retlfugt5m 869 retlfugt5m 870 retlfugt5m 871 retlfugt5m 872 retlfugt5m 873 retlfugt5m 874 retlfugt5m 875 retlfugt5m -
description ioc Process File deleted /var/log/daemon.log retlfugt5m - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp retlfugt5m - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 44 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/5/maps retlfugt5m File opened for reading /proc/9/maps retlfugt5m File opened for reading /proc/15/maps retlfugt5m File opened for reading /proc/21/maps retlfugt5m File opened for reading /proc/69/maps retlfugt5m File opened for reading /proc/72/maps retlfugt5m File opened for reading /proc/81/maps retlfugt5m File opened for reading /proc/711/maps retlfugt5m File opened for reading /proc/4/maps retlfugt5m File opened for reading /proc/13/maps retlfugt5m File opened for reading /proc/16/maps retlfugt5m File opened for reading /proc/159/maps retlfugt5m File opened for reading /proc/14/maps retlfugt5m File opened for reading /proc/71/maps retlfugt5m File opened for reading /proc/76/maps retlfugt5m File opened for reading /proc/82/maps retlfugt5m File opened for reading /proc/236/maps retlfugt5m File opened for reading /proc/10/maps retlfugt5m File opened for reading /proc/11/maps retlfugt5m File opened for reading /proc/22/maps retlfugt5m File opened for reading /proc/23/maps retlfugt5m File opened for reading /proc/24/maps retlfugt5m File opened for reading /proc/74/maps retlfugt5m File opened for reading /proc/77/maps retlfugt5m File opened for reading /proc/110/maps retlfugt5m File opened for reading /proc/3/maps retlfugt5m File opened for reading /proc/36/maps retlfugt5m File opened for reading /proc/127/maps retlfugt5m File opened for reading /proc/714/maps retlfugt5m File opened for reading /proc/37/maps retlfugt5m File opened for reading /proc/6/maps retlfugt5m File opened for reading /proc/8/maps retlfugt5m File opened for reading /proc/12/maps retlfugt5m File opened for reading /proc/18/maps retlfugt5m File opened for reading /proc/20/maps retlfugt5m File opened for reading /proc/126/maps retlfugt5m File opened for reading /proc/713/maps retlfugt5m File opened for reading /proc/2/maps retlfugt5m File opened for reading /proc/7/maps retlfugt5m File opened for reading /proc/19/maps retlfugt5m File opened for reading /proc/17/maps retlfugt5m File opened for reading /proc/73/maps retlfugt5m File opened for reading /proc/75/maps retlfugt5m File opened for reading /proc/78/maps retlfugt5m - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/bin/dbus-daemon 722 retlfugt5m - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp retlfugt5m -
description ioc Process File opened for reading /proc/18/stat retlfugt5m File opened for reading /proc/78/environ retlfugt5m File opened for reading /proc/4/fd retlfugt5m File opened for reading /proc/14/fd retlfugt5m File opened for reading /proc/77/status retlfugt5m File opened for reading /proc/159/stat retlfugt5m File opened for reading /proc/714/stat retlfugt5m File opened for reading /proc/16/environ retlfugt5m File opened for reading /proc/24/cmdline retlfugt5m File opened for reading /proc/69/fd retlfugt5m File opened for reading /proc/74/environ retlfugt5m File opened for reading /proc/81/stat retlfugt5m File opened for reading /proc/82/status retlfugt5m File opened for reading /proc/self/status retlfugt5m File opened for reading /proc/2/stat retlfugt5m File opened for reading /proc/76/status retlfugt5m File opened for reading /proc/15/fd retlfugt5m File opened for reading /proc/20/stat retlfugt5m File opened for reading /proc/24/stat retlfugt5m File opened for reading /proc/18/status retlfugt5m File opened for reading /proc/74/status retlfugt5m File opened for reading /proc/713/fd retlfugt5m File opened for reading /proc/783/cmdline retlfugt5m File opened for reading /proc/7/stat retlfugt5m File opened for reading /proc/81/status retlfugt5m File opened for reading /proc/1/cmdline retlfugt5m File opened for reading /proc/4/environ retlfugt5m File opened for reading /proc/5/environ retlfugt5m File opened for reading /proc/6/cmdline retlfugt5m File opened for reading /proc/37/cmdline retlfugt5m File opened for reading /proc/81/fd retlfugt5m File opened for reading /proc/127/cmdline retlfugt5m File opened for reading /proc/813/cmdline retlfugt5m File opened for reading /proc/10/status retlfugt5m File opened for reading /proc/13/environ retlfugt5m File opened for reading /proc/16/cmdline retlfugt5m File opened for reading /proc/24/status retlfugt5m File opened for reading /proc/24/fd retlfugt5m File opened for reading /proc/73/stat retlfugt5m File opened for reading /proc/110/fd retlfugt5m File opened for reading /proc/711/status retlfugt5m File opened for reading /proc/14/cmdline retlfugt5m File opened for reading /proc/17/status retlfugt5m File opened for reading /proc/22/fd retlfugt5m File opened for reading /proc/236/cmdline retlfugt5m File opened for reading /proc/724/cmdline retlfugt5m File opened for reading /proc/10/environ retlfugt5m File opened for reading /proc/10/stat retlfugt5m File opened for reading /proc/11/stat retlfugt5m File opened for reading /proc/22/cmdline retlfugt5m File opened for reading /proc/422/cmdline retlfugt5m File opened for reading /proc/4/stat retlfugt5m File opened for reading /proc/13/status retlfugt5m File opened for reading /proc/21/status retlfugt5m File opened for reading /proc/73/status retlfugt5m File opened for reading /proc/78/cmdline retlfugt5m File opened for reading /proc/716/cmdline retlfugt5m File opened for reading /proc/6/stat retlfugt5m File opened for reading /proc/21/environ retlfugt5m File opened for reading /proc/74/cmdline retlfugt5m File opened for reading /proc/4/status retlfugt5m File opened for reading /proc/126/fd retlfugt5m File opened for reading /proc/370/cmdline retlfugt5m File opened for reading /proc/713/environ retlfugt5m