76c744047cac0fb997f3ee1a1f00658bd2f4dc18259b212d7bef2b99f3ce0ea9

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
17/10/2026, 19:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cegg_mips.elf
Size 407KB
Sample261017-x6rwjayvcx
SHA256 76c744047cac0fb997f3ee1a1f00658bd2f4dc18259b212d7bef2b99f3ce0ea9
MD5 844fef7ef6e16a4f031c5b56366c27a6
SHA1 f5b07af99ad227cdb40cd8fa906dd460671c34fb
SHA512 829288d6ea9a36498a06f24af942c8f57c1dda377c27b36b8d017ea7eb742801a286853fc4e8e2b88aa12d8905d1ab049e08a80dd4563d4a9448b9a8dfd88732
SSDEEP 6144:lNT3BOcSMhpaNK+moBriXWy6RuvYE11CgRsisKhsoYQwzoW9ct3kqGLNA2W:U5Q+moBNy6ut3CgR+qsofeqC/W
TLSH
T1B69423ECB5E9FFEB623634329103246DAD1116D6B38C291E007866764CDD7F00AF6C6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (21497) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	cegg_mips.elf
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	ls

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
708	ip
770	ip
704	cegg_mips.elf
706	sh

/tmp/cegg_mips.elf
/tmp/cegg_mips.elf
1⤵
- Reads runtime system information
- System Network Configuration Discovery
PID:704
- /bin/sh
  sh -c -- "ip -4 route get 8.8.8.8 2>/dev/null | grep -oP 'src \\K[0-9.]+'"
  2⤵
  - System Network Configuration Discovery
  PID:706
- - /sbin/ip
    ip -4 route get 8.8.8.8
    3⤵
    - System Network Configuration Discovery
    PID:708
- - /bin/grep
    grep -oP "src \\K[0-9.]+"
    3⤵
    PID:709
- /bin/sh
  sh -c -- "ip -4 addr 2>/dev/null | grep 'inet ' | awk '{print \$2}' | cut -d/ -f1"
  2⤵
  PID:728
- - /sbin/ip
    ip -4 addr
    3⤵
    - System Network Configuration Discovery
    PID:770
- - /usr/bin/awk
    awk "{print \$2}"
    3⤵
    - Reads runtime system information
    PID:772
- - /bin/grep
    grep "inet "
    3⤵
    PID:771
- - /usr/bin/cut
    cut -d/ -f1
    3⤵
    PID:773
- /bin/sh
  sh -c -- "ls /home/ 2>/dev/null"
  2⤵
  PID:775
- - /bin/ls
    ls /home/
    3⤵
    - Reads runtime system information
    PID:776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads