Analysis
- max time kernel
149s - max time network
151s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
11/11/2026, 10:46
Behavioral task
behavioral1
Sample
0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf
Resource
debian9-mipsbe-20260513-en
debian-9-mips
7 signatures
150 seconds
General
- Target 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf
- Size 85KB
- Sample261111-mt2j4agh66
- SHA256 c66f6928096cfccfbe2081c0e4bd06be1474af44c0e325e89c33debb354dde82
- MD5 3a2fe18be54d38833fcf9916fa7d993a
- SHA1 0fb6d9edd62d2b16d516d2dfae683d2652478e73
- SHA512 cfd0055d5cba6a91204ca84f3575ed306e3934169a55099471d458e448c4d826586ab5e5710738495e678662c7ac08413aff775178c7d03dd07f08e469e532b6
- SSDEEP 1536:/Z5kVIPGGxjwp44GEGEM80vUWJWvrXuBfnQnUqvmMrlDy:DhPGGxjaB0cyWKBfnQnUqvhly
- TLSH T16E83944E3E219F7EFBAC823847F35A21964933DA36E1D584D15CEA021E7038A741FB95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Contacts a large (20141) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for modification /dev/misc/watchdog 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf -
description ioc Process File opened for reading /proc/397/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/675/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/719/exe 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/794/exe 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/153/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/440/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/683/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/730/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/732/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/712/exe 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/721/exe 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/802/exe 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/340/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/346/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/712/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/714/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/724/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/175/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/343/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/686/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/689/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/440/exe 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/790/exe 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/391/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/392/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/726/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/675/exe 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/686/exe 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/722/exe 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/347/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/731/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/1/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/252/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/348/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/688/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/728/fd 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/683/exe 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/728/exe 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/688/exe 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/689/exe 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/732/exe 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf File opened for reading /proc/744/exe 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a.elf