Analysis
- max time kernel
150s - max time network
141s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
12/10/2026, 17:23
Static task
static1
Behavioral task
behavioral1
Sample
main.mips32.elf
Resource
debian9-mipsbe-20260513-en
debian-9-mips
6 signatures
150 seconds
General
- Target main.mips32.elf
- Size 137KB
- Sample261012-vx8ftac161
- SHA256 cc3815c69070829bf121d1f8aeda00f7e98b654154f15369d26531651fc969bb
- MD5 81c4ef32ffbc1e829827b29a4a3070b5
- SHA1 87603509295cc2a76dd76a5438c374cbf5e48dbd
- SHA512 acbe492ad90796569ac06d751a46fbf260e1780deed4c07dab66857019a280afa32896f04b280f955fe08ade5180e244ba79f7afb553e2e007483f4d7759b557
- SSDEEP 1536:lhtddaR6Lk+cEBwbFy7JuWIWuRH2JiPH1Tp1eVQxRJn4dbc8sMmm8JuWwf9gMHlU:v9Y4dbhsXJuWwdHTalzA7fce1S
- TLSH T12CD319767710BFAAC36CD5300EF28AA48AF61A5215E354823375DA1CAE7051D2C9FEF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 714 main.mips32.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself init 714 main.mips32.elf -
description ioc Process File opened for reading /proc/77/cmdline main.mips32.elf File opened for reading /proc/719/cmdline main.mips32.elf File opened for reading /proc/720/cmdline main.mips32.elf File opened for reading /proc/726/cmdline main.mips32.elf File opened for reading /proc/729/cmdline main.mips32.elf File opened for reading /proc/732/cmdline main.mips32.elf File opened for reading /proc/763/cmdline main.mips32.elf File opened for reading /proc/23/cmdline main.mips32.elf File opened for reading /proc/7/cmdline main.mips32.elf File opened for reading /proc/10/cmdline main.mips32.elf File opened for reading /proc/75/cmdline main.mips32.elf File opened for reading /proc/250/cmdline main.mips32.elf File opened for reading /proc/337/cmdline main.mips32.elf File opened for reading /proc/702/cmdline main.mips32.elf File opened for reading /proc/739/cmdline main.mips32.elf File opened for reading /proc/662/cmdline main.mips32.elf File opened for reading /proc/760/cmdline main.mips32.elf File opened for reading /proc/762/cmdline main.mips32.elf File opened for reading /proc/800/cmdline main.mips32.elf File opened for reading /proc/110/cmdline main.mips32.elf File opened for reading /proc/678/cmdline main.mips32.elf File opened for reading /proc/709/cmdline main.mips32.elf File opened for reading /proc/750/cmdline main.mips32.elf File opened for reading /proc/775/cmdline main.mips32.elf File opened for reading /proc/83/cmdline main.mips32.elf File opened for reading /proc/13/cmdline main.mips32.elf File opened for reading /proc/20/cmdline main.mips32.elf File opened for reading /proc/73/cmdline main.mips32.elf File opened for reading /proc/81/cmdline main.mips32.elf File opened for reading /proc/753/cmdline main.mips32.elf File opened for reading /proc/756/cmdline main.mips32.elf File opened for reading /proc/815/cmdline main.mips32.elf File opened for reading /proc/4/cmdline main.mips32.elf File opened for reading /proc/704/cmdline main.mips32.elf File opened for reading /proc/734/cmdline main.mips32.elf File opened for reading /proc/770/cmdline main.mips32.elf File opened for reading /proc/771/cmdline main.mips32.elf File opened for reading /proc/175/cmdline main.mips32.elf File opened for reading /proc/717/cmdline main.mips32.elf File opened for reading /proc/780/cmdline main.mips32.elf File opened for reading /proc/796/cmdline main.mips32.elf File opened for reading /proc/819/cmdline main.mips32.elf File opened for reading /proc/14/cmdline main.mips32.elf File opened for reading /proc/36/cmdline main.mips32.elf File opened for reading /proc/746/cmdline main.mips32.elf File opened for reading /proc/754/cmdline main.mips32.elf File opened for reading /proc/758/cmdline main.mips32.elf File opened for reading /proc/759/cmdline main.mips32.elf File opened for reading /proc/766/cmdline main.mips32.elf File opened for reading /proc/791/cmdline main.mips32.elf File opened for reading /proc/15/cmdline main.mips32.elf File opened for reading /proc/76/cmdline main.mips32.elf File opened for reading /proc/673/cmdline main.mips32.elf File opened for reading /proc/737/cmdline main.mips32.elf File opened for reading /proc/751/cmdline main.mips32.elf File opened for reading /proc/786/cmdline main.mips32.elf File opened for reading /proc/798/cmdline main.mips32.elf File opened for reading /proc/809/cmdline main.mips32.elf File opened for reading /proc/125/cmdline main.mips32.elf File opened for reading /proc/731/cmdline main.mips32.elf File opened for reading /proc/811/cmdline main.mips32.elf File opened for reading /proc/816/cmdline main.mips32.elf File opened for reading /proc/1/cmdline main.mips32.elf File opened for reading /proc/17/cmdline main.mips32.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 714 main.mips32.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.Kdat_tmp main.mips32.elf