Analysis
- max time kernel
150s - max time network
150s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
14/10/2026, 22:21
Static task
static1
Behavioral task
behavioral1
Sample
iran.mips.elf
Resource
debian9-mipsbe-20260513-en
debian-9-mips
5 signatures
150 seconds
General
- Target iran.mips.elf
- Size 202KB
- Sample261014-19rayszy4r
- SHA256 e05e7370ae270f112c1e99addae6454d97f39cef3518009e779ddd6c36d1c0ef
- MD5 4566735183bc0632f481ba7bc80b24f2
- SHA1 c0bb48b0d1bfdd241077a8068b3f8f3a3e21b403
- SHA512 b0cb53a696514889ef7ef02507ab761c484bd2a841ae725fd41d0e6bdb7374a7e5abb9cd95685ee01b0316b5cebe18f53b279b0b977d1297e38c3de49ff46c74
- SSDEEP 3072:Sxrne9qN2XlTIrAkgUffj4HKdY63gtrh9ptPaRRMs:S1ne9qN2VMjHsT6cV9pVaLV
- TLSH T1AD14975E6E328F7EF268C73447B74A34975D22D627E1DA84D2ACC1045E6034E681FFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/xs.main iran.mips.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself -sh 709 iran.mips.elf -
description ioc Process File opened for reading /proc/710/stat iran.mips.elf File opened for reading /proc/12/stat iran.mips.elf File opened for reading /proc/739/comm iran.mips.elf File opened for reading /proc/782/comm iran.mips.elf File opened for reading /proc/373/comm iran.mips.elf File opened for reading /proc/19/comm iran.mips.elf File opened for reading /proc/21/cmdline iran.mips.elf File opened for reading /proc/36/status iran.mips.elf File opened for reading /proc/726/cmdline iran.mips.elf File opened for reading /proc/747/comm iran.mips.elf File opened for reading /proc/115/comm iran.mips.elf File opened for reading /proc/24/stat iran.mips.elf File opened for reading /proc/146/comm iran.mips.elf File opened for reading /proc/4/stat iran.mips.elf File opened for reading /proc/21/status iran.mips.elf File opened for reading /proc/325/cmdline iran.mips.elf File opened for reading /proc/703/exe iran.mips.elf File opened for reading /proc/751/stat iran.mips.elf File opened for reading /proc/778/status iran.mips.elf File opened for reading /proc/15/comm iran.mips.elf File opened for reading /proc/17/cmdline iran.mips.elf File opened for reading /proc/76/status iran.mips.elf File opened for reading /proc/18/comm iran.mips.elf File opened for reading /proc/321/comm iran.mips.elf File opened for reading /proc/16/cmdline iran.mips.elf File opened for reading /proc/77/stat iran.mips.elf File opened for reading /proc/743/stat iran.mips.elf File opened for reading /proc/773/status iran.mips.elf File opened for reading /proc/782/status iran.mips.elf File opened for reading /proc/782/cmdline iran.mips.elf File opened for reading /proc/105/cmdline iran.mips.elf File opened for reading /proc/233/stat iran.mips.elf File opened for reading /proc/702/cmdline iran.mips.elf File opened for reading /proc/751/comm iran.mips.elf File opened for reading /proc/778/cmdline iran.mips.elf File opened for reading /proc/808/cmdline iran.mips.elf File opened for reading /proc/13/comm iran.mips.elf File opened for reading /proc/3/comm iran.mips.elf File opened for reading /proc/16/comm iran.mips.elf File opened for reading /proc/695/comm iran.mips.elf File opened for reading /proc/756/exe iran.mips.elf File opened for reading /proc/761/comm iran.mips.elf File opened for reading /proc/325/comm iran.mips.elf File opened for reading /proc/72/stat iran.mips.elf File opened for reading /proc/72/status iran.mips.elf File opened for reading /proc/74/stat iran.mips.elf File opened for reading /proc/798/stat iran.mips.elf File opened for reading /proc/799/stat iran.mips.elf File opened for reading /proc/21/comm iran.mips.elf File opened for reading /proc/8/stat iran.mips.elf File opened for reading /proc/780/stat iran.mips.elf File opened for reading /proc/795/stat iran.mips.elf File opened for reading /proc/808/stat iran.mips.elf File opened for reading /proc/165/comm iran.mips.elf File opened for reading /proc/20/status iran.mips.elf File opened for reading /proc/424/cmdline iran.mips.elf File opened for reading /proc/756/cmdline iran.mips.elf File opened for reading /proc/786/stat iran.mips.elf File opened for reading /proc/7/comm iran.mips.elf File opened for reading /proc/11/cmdline iran.mips.elf File opened for reading /proc/20/stat iran.mips.elf File opened for reading /proc/669/comm iran.mips.elf File opened for reading /proc/14/stat iran.mips.elf File opened for reading /proc/730/stat iran.mips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 706 iran.mips.elf
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/init.d/xs.main
- Size 30B
- SHA256 96bcccd26a8e9916488d0518696dd03516dee1902a5a9b1b511e5795b3f49578
- MD5 5240aa3794227a4aff7f4a91ad155fab
- SHA1 30a3df0bd5fc494c093a5f703617f7a0cf25ef75
- SHA512 66e1306ec356f203c9b8bc9bef215c69aff0355a855171b15b0a74d10b2858773755814f4fe07daf25fcc2a653eabea017d8c4431177bed665d0f0abb9620949
- MD5 SHA1 SHA512