Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    11/10/2026, 23:39

General

  • Target
    mips.elf
  • Size 176KB
  • Sample261011-3nc8babe57
  • SHA256 6a391f69de3c24d7fa7f3a24540255ccb530955b8d4b2a4a4673759589613288
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Detects Mirai 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Traces itself 1 IoCs

    Traces itself to prevent debugging attempts

  • Unexpected DNS network traffic destination 10 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job 1 TTPs 5 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Creates/modifies environment variables 1 TTPs 7 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

  • Deletes log files 1 TTPs 1 IoCs

    Deletes log files on the system.

  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

  • Modifies systemd 2 TTPs 2 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

  • Write file to user bin folder 4 IoCs
  • Writes file to system bin folder 1 IoCs
  • Modifies Bash startup script 2 TTPs 6 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Changes its process name 4 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Creates a desktop entry file 3 TTPs 1 IoCs

    A .desktop file is used by desktop environments to register and launch applications. This can be abused to gain persistence.

  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 21 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to shm directory 2 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/mips.elf
    /tmp/mips.elf
    1⤵
    • Executes dropped EXE
    • Modifies Watchdog functionality
    • Traces itself
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Deletes log files
    • Enumerates active TCP sockets
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Write file to user bin folder
    • Writes file to system bin folder
    • Modifies Bash startup script
    • Changes its process name
    • Checks CPU configuration
    • Creates a desktop entry file
    • Reads system network configuration
    • Reads runtime system information
    • System Network Configuration Discovery
    • Writes file to shm directory
    • Writes file to tmp directory
    PID:712
    • /usr/local/sbin/systemctl
      systemctl daemon-reload
      2⤵
        PID:822
      • /usr/local/bin/systemctl
        systemctl daemon-reload
        2⤵
          PID:822
        • /usr/sbin/systemctl
          systemctl daemon-reload
          2⤵
            PID:822
          • /usr/bin/systemctl
            systemctl daemon-reload
            2⤵
              PID:822
            • /sbin/systemctl
              systemctl daemon-reload
              2⤵
                PID:822
              • /bin/systemctl
                systemctl daemon-reload
                2⤵
                • Enumerates kernel/hardware configuration
                • Reads runtime system information
                PID:822
              • /usr/local/sbin/systemctl
                systemctl enable network-dispatch.service
                2⤵
                  PID:835
                • /usr/local/bin/systemctl
                  systemctl enable network-dispatch.service
                  2⤵
                    PID:835
                  • /usr/sbin/systemctl
                    systemctl enable network-dispatch.service
                    2⤵
                      PID:835
                    • /usr/bin/systemctl
                      systemctl enable network-dispatch.service
                      2⤵
                        PID:835
                      • /sbin/systemctl
                        systemctl enable network-dispatch.service
                        2⤵
                          PID:835
                        • /bin/systemctl
                          systemctl enable network-dispatch.service
                          2⤵
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:835
                        • /usr/local/sbin/systemctl
                          systemctl enable network-dispatch.timer
                          2⤵
                            PID:848
                          • /usr/local/bin/systemctl
                            systemctl enable network-dispatch.timer
                            2⤵
                              PID:848
                            • /usr/sbin/systemctl
                              systemctl enable network-dispatch.timer
                              2⤵
                                PID:848
                              • /usr/bin/systemctl
                                systemctl enable network-dispatch.timer
                                2⤵
                                  PID:848
                                • /sbin/systemctl
                                  systemctl enable network-dispatch.timer
                                  2⤵
                                    PID:848
                                  • /bin/systemctl
                                    systemctl enable network-dispatch.timer
                                    2⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:848
                                  • /usr/local/sbin/systemctl
                                    systemctl enable network-dispatch.path
                                    2⤵
                                      PID:861
                                    • /usr/local/bin/systemctl
                                      systemctl enable network-dispatch.path
                                      2⤵
                                        PID:861
                                      • /usr/sbin/systemctl
                                        systemctl enable network-dispatch.path
                                        2⤵
                                          PID:861
                                        • /usr/bin/systemctl
                                          systemctl enable network-dispatch.path
                                          2⤵
                                            PID:861
                                          • /sbin/systemctl
                                            systemctl enable network-dispatch.path
                                            2⤵
                                              PID:861
                                            • /bin/systemctl
                                              systemctl enable network-dispatch.path
                                              2⤵
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:861
                                            • /usr/local/sbin/nvram
                                              nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                              2⤵
                                                PID:874
                                              • /usr/local/bin/nvram
                                                nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                                2⤵
                                                  PID:874
                                                • /usr/sbin/nvram
                                                  nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                                  2⤵
                                                    PID:874
                                                  • /usr/bin/nvram
                                                    nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                                    2⤵
                                                      PID:874
                                                    • /sbin/nvram
                                                      nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                                      2⤵
                                                        PID:874
                                                      • /bin/nvram
                                                        nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                                        2⤵
                                                          PID:874
                                                        • /usr/local/sbin/nvram
                                                          nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                                          2⤵
                                                            PID:875
                                                          • /usr/local/bin/nvram
                                                            nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                                            2⤵
                                                              PID:875
                                                            • /usr/sbin/nvram
                                                              nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                                              2⤵
                                                                PID:875
                                                              • /usr/bin/nvram
                                                                nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                                                2⤵
                                                                  PID:875
                                                                • /sbin/nvram
                                                                  nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                                                  2⤵
                                                                    PID:875
                                                                  • /bin/nvram
                                                                    nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                                                    2⤵
                                                                      PID:875
                                                                    • /usr/local/sbin/nvram
                                                                      nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                                      2⤵
                                                                        PID:876
                                                                      • /usr/local/bin/nvram
                                                                        nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                                        2⤵
                                                                          PID:876
                                                                        • /usr/sbin/nvram
                                                                          nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                                          2⤵
                                                                            PID:876
                                                                          • /usr/bin/nvram
                                                                            nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                                            2⤵
                                                                              PID:876
                                                                            • /sbin/nvram
                                                                              nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                                              2⤵
                                                                                PID:876
                                                                              • /bin/nvram
                                                                                nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                                                2⤵
                                                                                  PID:876
                                                                                • /usr/local/sbin/nvram
                                                                                  nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                                  2⤵
                                                                                    PID:877
                                                                                  • /usr/local/bin/nvram
                                                                                    nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                                    2⤵
                                                                                      PID:877
                                                                                    • /usr/sbin/nvram
                                                                                      nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                                      2⤵
                                                                                        PID:877
                                                                                      • /usr/bin/nvram
                                                                                        nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                                        2⤵
                                                                                          PID:877
                                                                                        • /sbin/nvram
                                                                                          nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                                          2⤵
                                                                                            PID:877
                                                                                          • /bin/nvram
                                                                                            nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                                            2⤵
                                                                                              PID:877
                                                                                            • /usr/local/sbin/nvram
                                                                                              nvram commit
                                                                                              2⤵
                                                                                                PID:878
                                                                                              • /usr/local/bin/nvram
                                                                                                nvram commit
                                                                                                2⤵
                                                                                                  PID:878
                                                                                                • /usr/sbin/nvram
                                                                                                  nvram commit
                                                                                                  2⤵
                                                                                                    PID:878
                                                                                                  • /usr/bin/nvram
                                                                                                    nvram commit
                                                                                                    2⤵
                                                                                                      PID:878
                                                                                                    • /sbin/nvram
                                                                                                      nvram commit
                                                                                                      2⤵
                                                                                                        PID:878
                                                                                                      • /bin/nvram
                                                                                                        nvram commit
                                                                                                        2⤵
                                                                                                          PID:878
                                                                                                        • /usr/local/sbin/fw_printenv
                                                                                                          fw_printenv bootcmd
                                                                                                          2⤵
                                                                                                            PID:879
                                                                                                          • /usr/local/bin/fw_printenv
                                                                                                            fw_printenv bootcmd
                                                                                                            2⤵
                                                                                                              PID:879
                                                                                                            • /usr/sbin/fw_printenv
                                                                                                              fw_printenv bootcmd
                                                                                                              2⤵
                                                                                                                PID:879
                                                                                                              • /usr/bin/fw_printenv
                                                                                                                fw_printenv bootcmd
                                                                                                                2⤵
                                                                                                                  PID:879
                                                                                                                • /sbin/fw_printenv
                                                                                                                  fw_printenv bootcmd
                                                                                                                  2⤵
                                                                                                                    PID:879
                                                                                                                  • /bin/fw_printenv
                                                                                                                    fw_printenv bootcmd
                                                                                                                    2⤵
                                                                                                                      PID:879
                                                                                                                    • /etc/init.d/network-dispatch
                                                                                                                      /etc/init.d/network-dispatch enable
                                                                                                                      2⤵
                                                                                                                        PID:880
                                                                                                                      • /usr/local/sbin/rc-update
                                                                                                                        rc-update add network-dispatch
                                                                                                                        2⤵
                                                                                                                          PID:881
                                                                                                                        • /usr/local/bin/rc-update
                                                                                                                          rc-update add network-dispatch
                                                                                                                          2⤵
                                                                                                                            PID:881
                                                                                                                          • /usr/sbin/rc-update
                                                                                                                            rc-update add network-dispatch
                                                                                                                            2⤵
                                                                                                                              PID:881
                                                                                                                            • /usr/bin/rc-update
                                                                                                                              rc-update add network-dispatch
                                                                                                                              2⤵
                                                                                                                                PID:881
                                                                                                                              • /sbin/rc-update
                                                                                                                                rc-update add network-dispatch
                                                                                                                                2⤵
                                                                                                                                  PID:881
                                                                                                                                • /bin/rc-update
                                                                                                                                  rc-update add network-dispatch
                                                                                                                                  2⤵
                                                                                                                                    PID:881

                                                                                                                                Network

                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      .network-dispatch

                                                                                                                                      • Path /dev/mqueue/.network-dispatch
                                                                                                                                      • Size 4KB
                                                                                                                                      • SHA256 83e9578d9f2d27072c130f042f11ef68220f8971ba490086e881b6a656228e71
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      99-net

                                                                                                                                      • Path /etc/NetworkManager/dispatcher.d/99-net
                                                                                                                                      • Size 210B
                                                                                                                                      • SHA256 776d1761eae08b8cfc6e2a8e8699b9f4d03612652dccdce1945faeb689bfeafb
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      99-net

                                                                                                                                      • Path /etc/apt/apt.conf.d/99-net
                                                                                                                                      • Size 106B
                                                                                                                                      • SHA256 1b1231ac2da301495d86a53afc51256f9bb669db34eb313681f4d6f6c3999fff
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      network-dispatch

                                                                                                                                      • Path /etc/cron.d/network-dispatch
                                                                                                                                      • Size 47B
                                                                                                                                      • SHA256 16507b05a1d7ef9d9456cbf301a2864904b8eb457fdc52c2c7c6933029c0e1c6
                                                                                                                                      • MD5 SHA1 SHA512

                                                                                                                                      network-dispatch

                                                                                                                                      • Path /etc/cron.hourly/network-dispatch
                                                                                                                                      • Size 153B
                                                                                                                                      • SHA256 e697cfb597843583c2ba1fead9bb44cd19a77964d1d80e4b5a654cf5b7716049
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      net

                                                                                                                                      • Path /etc/dhcp/dhclient-exit-hooks.d/net
                                                                                                                                      • Size 155B
                                                                                                                                      • SHA256 060d71aff2e29495b1504502181fcafc057a357e1eea08bcf577139fb856eda7
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      network-dispatch

                                                                                                                                      • Path /etc/dinit.d/network-dispatch
                                                                                                                                      • Size 113B
                                                                                                                                      • SHA256 4b7155af80fe3e49f510c8f6eae1ece9fe0e8ef049a0f03e3e6541e4279dc094
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      inetd.conf

                                                                                                                                      • Path /etc/inetd.conf
                                                                                                                                      • Size 94B
                                                                                                                                      • SHA256 57fae5c95bbd8f5a4d0b1bb7a8dbc013da6af6719109b42e76fcd76c78714e91
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      network-dispatch

                                                                                                                                      • Path /etc/init.d/network-dispatch
                                                                                                                                      • Size 274B
                                                                                                                                      • SHA256 789ca44e264ccab23b87f19a7caad559621c915965f2c5c79b7750a77fd03e68
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      network-dispatch

                                                                                                                                      • Path /etc/init.d/network-dispatch
                                                                                                                                      • Size 212B
                                                                                                                                      • SHA256 0a37c1a8d049918041b5ce44091ff75ff30399afde95f3ed5f3d1c4f9ae6340d
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      network-dispatch

                                                                                                                                      • Path /etc/init.d/network-dispatch
                                                                                                                                      • Size 162B
                                                                                                                                      • SHA256 b4b2f8b02d369f1e66c96ed4f829ad1ce9338ef5e0b34c3e9de4943fe97fcd2a
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      inittab

                                                                                                                                      • Path /etc/inittab
                                                                                                                                      • Size 43B
                                                                                                                                      • SHA256 da40a0f49a0445ccce643f0bdd1b0d7a973887049de319715e42b05b14e4c1a3
                                                                                                                                      • MD5 SHA1 SHA512

                                                                                                                                      network-dispatch.start

                                                                                                                                      • Path /etc/local.d/network-dispatch.start
                                                                                                                                      • Size 88B
                                                                                                                                      • SHA256 6c9c89370a346bffd0fb49fbacd5e6cc0419ccbea43fe3640494dc9163fb3f86
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      keeprc.conf

                                                                                                                                      • Path /etc/opkg/keeprc.conf
                                                                                                                                      • Size 54B
                                                                                                                                      • SHA256 7cf39b594679820bedec1cbb2aca992ae9e02106ae2e2b7db2036355e6644c0d
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      00-net.sh

                                                                                                                                      • Path /etc/profile.d/00-net.sh
                                                                                                                                      • Size 104B
                                                                                                                                      • SHA256 f48aa622f48b7b1d21ae011bbd029444bbe64d3db4455583c1502ab3234f8237
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      network-dispatch-gen

                                                                                                                                      • Path /etc/systemd/system-generators/network-dispatch-gen
                                                                                                                                      • Size 387B
                                                                                                                                      • SHA256 8ba6bf8e42767ace35afdc90bcdeeec40343e05a662c1b1d21217190806ec325
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      network-dispatch.service

                                                                                                                                      • Path /etc/systemd/system/network-dispatch.service
                                                                                                                                      • Size 228B
                                                                                                                                      • SHA256 f0a4522d9cacf37bc711ef07c7a07d2627ac3fb2a25e13e1695db14896da415e
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      99-network-dispatch.rules

                                                                                                                                      • Path /etc/udev/rules.d/99-network-dispatch.rules
                                                                                                                                      • Size 144B
                                                                                                                                      • SHA256 42a9eef129fbeeaca0319f9309d96f1395b8fb80f3b50bec77550acf10d4b376
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      network-dispatch.desktop

                                                                                                                                      • Path /etc/xdg/autostart/network-dispatch.desktop
                                                                                                                                      • Size 150B
                                                                                                                                      • SHA256 9e4b415925f30fa0dc525855d2269f7a90d712714ba5ec64b4cdd9e628a517b6
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      .bash_profile

                                                                                                                                      • Path /root/.bash_profile
                                                                                                                                      • Size 95B
                                                                                                                                      • SHA256 e89e5301a59ce3fb142a5e91407aa628339ca08123fb850acfea056ee059db91
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      network-dispatch.service

                                                                                                                                      • Path /root/.config/systemd/user/network-dispatch.service
                                                                                                                                      • Size 152B
                                                                                                                                      • SHA256 8493e90ac274688355fba972b6898b69fa003b1c742ad77b026a3518fbbea18d
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      network-dispatch

                                                                                                                                      • Path /usr/local/bin/network-dispatch
                                                                                                                                      • Size 176KB
                                                                                                                                      • SHA256 6a391f69de3c24d7fa7f3a24540255ccb530955b8d4b2a4a4673759589613288
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                                                      watchdog-net

                                                                                                                                      • Path /usr/local/bin/watchdog-net
                                                                                                                                      • Size 186B
                                                                                                                                      • SHA256 39524eda228aa5586b775c3fa9b2b3a5b4e114ae0cf1e3f284fb5d0a2a87a8e5
                                                                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                                                                      root

                                                                                                                                      • Path /var/spool/cron/crontabs/root
                                                                                                                                      • Size 126B
                                                                                                                                      • SHA256 84512cb49c634de2560f05a51fd68808c610dd6af6c4adccb5e5b022f1006e7a
                                                                                                                                      • MD5 SHA1 SHA512 TLSH