General
- Target bot.mips.elf
- Size 257KB
- Sample261024-lvntysg16w
- SHA256 49ca3c99f15ae026938fec0fae18173a8a77976e0cd5f7f2e22b9ff7ef261bbc
- MD5 eaae975ac079cd8309d91850ddaa2b70
- SHA1 5da5f4bfa8b9c8e5918200903cf2ca69ff918a52
- SHA512 48e68381d94495c5fcf3ddfc6d32b64f8b17d3d818f248e76b4d4003c6d1cdb0f815a5116d8e37d2821cbc7f46a86c21939d2864b9ea0ac42a99c5a18d7b2943
- SSDEEP 6144:iNQ3OJVsCoK+UUY3t5L3tXHvZCw1te+jVROI6KjXA8ZydAb:gQwKUUY3t5L3tXPZHHT5Uu
- TLSH T110443A8B77118FE1E739D67007F38A677BA612D216D28450E36CD9217A6034D6C2FFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
bot.mips.elf
Resource
debian9-mipsbe-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target bot.mips.elf
- Size 257KB
- SHA256 49ca3c99f15ae026938fec0fae18173a8a77976e0cd5f7f2e22b9ff7ef261bbc
- MD5 eaae975ac079cd8309d91850ddaa2b70
- SHA1 5da5f4bfa8b9c8e5918200903cf2ca69ff918a52
- SHA512 48e68381d94495c5fcf3ddfc6d32b64f8b17d3d818f248e76b4d4003c6d1cdb0f815a5116d8e37d2821cbc7f46a86c21939d2864b9ea0ac42a99c5a18d7b2943
- SSDEEP 6144:iNQ3OJVsCoK+UUY3t5L3tXHvZCw1te+jVROI6KjXA8ZydAb:gQwKUUY3t5L3tXPZHHT5Uu
- TLSH T110443A8B77118FE1E739D67007F38A677BA612D216D28450E36CD9217A6034D6C2FFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
2RC Scripts
2Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
2RC Scripts
2Scheduled Task/Job
1Cron
1Defense Evasion
Impair Defenses
1Virtualization/Sandbox Evasion
1System Checks
1