ad190210f40c8a4c6e9c9f07c82251033760e0d5a46b3d79cb1e830a313772e5

Analysis

max time kernel
149s
max time network
152s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
23/10/2026, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bot.mips
Size 724KB
Sample261023-asmnbsbs4k
SHA256 ad190210f40c8a4c6e9c9f07c82251033760e0d5a46b3d79cb1e830a313772e5
MD5 bb188d0485e9cea5898af98f0e910402
SHA1 efed40a913f43ba97d54a92600bfd8a531834b6c
SHA512 7bffc0c4c79c3ef4f673285b81beeed6ba1cde42de2ed5cdef726c4d9588f9a20456e920f846edf0032944704dda9660aa5e637d94a274669dc5d7cf498de355
SSDEEP 12288:SfAen5SRC3vm6TMA73iz8r2Di+LqRn8SqYn3Tozow1gxQWwxScMv8jaERcfQp5Dw:Sf7Q0+64I3hIzLqRX3Tozow1gGWwxScA
TLSH
T10EF47C2373528F94E365D2B001F28B6499A515B30BE349C653BCD624FE9067C6C6FEE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
706	bot.mips

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	aaaaaaaa	705	bot.mips

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
705	bot.mips

/tmp/bot.mips
/tmp/bot.mips
1⤵
- Deletes itself
- Changes its process name
- System Network Configuration Discovery
PID:705
- /bin/systemctl
  systemctl daemon-reload enable bot.service
  2⤵
  - Reads runtime system information
  PID:710
- /bin/systemctl
  systemctl daemon-reload enable bot.service
  2⤵
  - Reads runtime system information
  PID:825
- /bin/systemctl
  systemctl daemon-reload enable bot.service
  2⤵
  - Reads runtime system information
  PID:836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot

Path /etc/cron.d/bot
Size 38B
SHA256 c85798bca63b744f4afcee24c4af9607395757d1309d7eb84bd70d8aa07acc44
MD5 2cd7ecf938260aae635234546711eeff
SHA1 e72222d77f853412cd3607c224b84f52bd7f0193
SHA512 93102dc20957c96d7cb3dafe37888915ddf8c397b42f5e9ae9b3c0371618003b45ac66292a53e370dab16157f03373e9fb8ba40a5cde83a73bb41efefefa984c
MD5 SHA1 SHA512

Submit Download

bot

Path /etc/init.d/bot
Size 48B
SHA256 89a18fc29500523d15324a77d89c3086105c7181a685726d603329cd2d425abc
MD5 d6ffe2f4236e488712ba9043c19a72b1
SHA1 7437056aee34f43f782a0d82a289ce075df66d32
SHA512 541167aee6e75b5634b1a8b103dad4a8d6b7d8bc9a35e202599a75ba823d54735c04de8110c07aaa640d60b74208a7763fb33810c92b2ddea33d4d804f7b2a7a
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 76B
SHA256 684bd5b89638563af1a387bd79c37fe56790fd7aac2a833a68a6445e8d351212
MD5 43a51ae71553e00eb9930fd08a2edae5
SHA1 0c6317f5437a22b00946e2d12d5a756124352dbd
SHA512 f151b943924d261070f83ebbd7cb2bc2e46e4d24ea901ec02ad16515e1173c454ead3818a7ffcd77942bfbeebe4bad9290d1b2da2c61a8e10ef36e1125de65a7
TLSH
T1CFA0022022CDBAB338F3381E3034003BC8EACAAE098801C03AA2F8F948600030B00B0A
MD5 SHA1 SHA512 TLSH

Submit Download

rc.local

Path /etc/rc.local
Size 114B
SHA256 c7c498cc1e1aafc84e0578652c85c708f22a611db38083334dcec1c0b8e0e3e9
MD5 292fe2802640e7eaef4c74e24ce86f29
SHA1 14ad31fd50af005b6e1e7c6a618910f9523e36ff
SHA512 2174c4fd2ced9a14476635af7162308210a77a40cb8663afb424f6e8e290139ee7c55e067dfaf23d4b3b304090eb9984037a5683a06ab9cf3f3338dba3470adf
TLSH
T188B0022022CDBAB338F3381E3034003BC8EACAAE098801C03AA2F8F948600030B00B0A
MD5 SHA1 SHA512 TLSH

Submit Download

rc.local

Path /etc/rc.local
Size 38B
SHA256 831b0850f4093f089b8bb817fa617793f969f06726d5e5c5e0e49dead173583a
MD5 92de32b0189a03859ef1eb23fddd4f68
SHA1 2977f67bc1ca717f5d12545229c3c3c65e475bd8
SHA512 cc8df5dc2230a5bdb14623113e4783c2b7811473c1f45bdd8dde987a0ca5cd12bb90793e7fa1d421536ee3de75a65fcdd20dda9197e1d367c594bdb844d01949
MD5 SHA1 SHA512

Submit Download

.dbus-session.lock

Path /tmp/.dbus-session.lock
Size 4B
SHA256 e5797c6e1f5f830df8413056460a3a5e4b2990834092d8824cf9af1354603424
MD5 972f2c80334e1797d339a3e3925cfcec
SHA1 a3b5d8b1d90b4206ffa4b77984bb3364031a1199
SHA512 553e8bf4059ae5d7ff85fdfe39981bfb376e49f775a68385f58acb7f43225fdddfa662ce7ecca2f59afdd3a7a689593c15158d9b37c6558bb272a24eb054df8a
MD5 SHA1 SHA512

Submit Download

bot.new

Path /var/lib/dbus-glib/bot.new
Size 724KB
SHA256 ad190210f40c8a4c6e9c9f07c82251033760e0d5a46b3d79cb1e830a313772e5
MD5 bb188d0485e9cea5898af98f0e910402
SHA1 efed40a913f43ba97d54a92600bfd8a531834b6c
SHA512 7bffc0c4c79c3ef4f673285b81beeed6ba1cde42de2ed5cdef726c4d9588f9a20456e920f846edf0032944704dda9660aa5e637d94a274669dc5d7cf498de355
SSDEEP 12288:SfAen5SRC3vm6TMA73iz8r2Di+LqRn8SqYn3Tozow1gxQWwxScMv8jaERcfQp5Dw:Sf7Q0+64I3hIzLqRX3Tozow1gGWwxScA
TLSH
T10EF47C2373528F94E365D2B001F28B6499A515B30BE349C653BCD624FE9067C6C6FEE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

root

Path /var/spool/cron/crontabs/root
Size 33B
SHA256 ca01cfd134ba36a3caa5396626f89040d967a70e83ccdd6e57a130d6313dba1f
MD5 47c16f2f78461c52b1cae2377f90d4f8
SHA1 d2841f8b14f8ced06cafa74c3bfc78bf4bfa240b
SHA512 566dae2371d3740cf4f80404f6acd8130d4e2a51f3467f92ae241f9180d4c4ef28c5f72b1eab0ac60f237c130bf5f4cc1364ae7140ec750307ac46d5ddcc8b36
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads