Analysis
- max time kernel
150s - max time network
151s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
27/10/2026, 13:41
Behavioral task
behavioral1
Sample
pmips.elf
Resource
debian9-mipsbe-20260513-en
debian-9-mips
5 signatures
150 seconds
General
- Target pmips.elf
- Size 180KB
- Sample261027-qzcppstzhs
- SHA256 4330d1a089da239b0d4367c5b11ec74a9209116b9e425c8c5fb662ee30481125
- MD5 816d18cd0b63d23cb5fd51d712054506
- SHA1 954acf1342f67b5a30c08debf337ce39ed1ec291
- SHA512 32ff034a25a3740e8e087470236efbed4fffedb92bfe599bc94228c8925fff1bcf73dbb216e6cf4c7fe36030cabf3d74d4a83dab2823372189dbd767a7e9a270
- SSDEEP 3072:KG4QWnHlfO4JJHLRugrUNYTjNSFMkpvaunFXnwAly9KK3WB0asVWT5M2JIFb1lI0:KG4QWnFfO4JJrRugrU2OMkFafj9E0VWc
- TLSH T17104736B6E10DF29F65C97310AF76D34835A23A72AE5EA4AC15FC2002E3135D5C0FAB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 712 pmips.elf - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog pmips.elf File opened for modification /dev/watchdog pmips.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself 6lrk086g8sdnjk02af77bgrup1sa 712 pmips.elf -
description ioc Process File opened for reading /proc/796cmdline pmips.elf File opened for reading /proc/37cmdline pmips.elf File opened for reading /proc/715cmdline pmips.elf File opened for reading /proc/735cmdline pmips.elf File opened for reading /proc/738cmdline pmips.elf File opened for reading /proc/755cmdline pmips.elf File opened for reading /proc/784cmdline pmips.elf File opened for reading /proc/787cmdline pmips.elf File opened for reading /proc/789cmdline pmips.elf File opened for reading /proc/23cmdline pmips.elf File opened for reading /proc/153cmdline pmips.elf File opened for reading /proc/678cmdline pmips.elf File opened for reading /proc/728cmdline pmips.elf File opened for reading /proc/733cmdline pmips.elf File opened for reading /proc/743cmdline pmips.elf File opened for reading /proc/745cmdline pmips.elf File opened for reading /proc/798cmdline pmips.elf File opened for reading /proc/236cmdline pmips.elf File opened for reading /proc/726cmdline pmips.elf File opened for reading /proc/775cmdline pmips.elf File opened for reading /proc/806cmdline pmips.elf File opened for reading /proc/814cmdline pmips.elf File opened for reading /proc/158cmdline pmips.elf File opened for reading /proc/172cmdline pmips.elf File opened for reading /proc/682cmdline pmips.elf File opened for reading /proc/721cmdline pmips.elf File opened for reading /proc/757cmdline pmips.elf File opened for reading /proc/5cmdline pmips.elf File opened for reading /proc/18cmdline pmips.elf File opened for reading /proc/337cmdline pmips.elf File opened for reading /proc/742cmdline pmips.elf File opened for reading /proc/765cmdline pmips.elf File opened for reading /proc/788cmdline pmips.elf File opened for reading /proc/725cmdline pmips.elf File opened for reading /proc/808cmdline pmips.elf File opened for reading /proc/1cmdline pmips.elf File opened for reading /proc/2cmdline pmips.elf File opened for reading /proc/3cmdline pmips.elf File opened for reading /proc/81cmdline pmips.elf File opened for reading /proc/708cmdline pmips.elf File opened for reading /proc/717cmdline pmips.elf File opened for reading /proc/732cmdline pmips.elf File opened for reading /proc/777cmdline pmips.elf File opened for reading /proc/7cmdline pmips.elf File opened for reading /proc/20cmdline pmips.elf File opened for reading /proc/78cmdline pmips.elf File opened for reading /proc/342cmdline pmips.elf File opened for reading /proc/701cmdline pmips.elf File opened for reading /proc/727cmdline pmips.elf File opened for reading /proc/792cmdline pmips.elf File opened for reading /proc/810cmdline pmips.elf File opened for reading /proc/778cmdline pmips.elf File opened for reading /proc/125cmdline pmips.elf File opened for reading /proc/338cmdline pmips.elf File opened for reading /proc/741cmdline pmips.elf File opened for reading /proc/746cmdline pmips.elf File opened for reading /proc/9cmdline pmips.elf File opened for reading /proc/76cmdline pmips.elf File opened for reading /proc/673cmdline pmips.elf File opened for reading /proc/748cmdline pmips.elf File opened for reading /proc/763cmdline pmips.elf File opened for reading /proc/767cmdline pmips.elf File opened for reading /proc/771cmdline pmips.elf File opened for reading /proc/6cmdline pmips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 712 pmips.elf