Overview

overview

10

Static

static

10

jew.mpsl.elf

debian-9-mipsel

9

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240611-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    01-07-2024 21:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    jew.mpsl.elf

  • Size

    86KB

  • MD5

    ea1a69894f740cee70dabfe41b43230b

  • SHA1

    2d3ac620a4904c1f33bf4848e493090c5fc8263a

  • SHA256

    8bc2c42c5f38ecdcc9c3c1b630638d6cdae9c3a06ce4602b74d3e8ebff9a7f74

  • SHA512

    dd7b19bb8efcfddff6ef70a724eb06326a9318474719390a542a8fb7a4fd540e1866486b40784214af78edacb0dfed6fda4d6fe6c1bc19557a08d908ec5aa2a6

  • SSDEEP

    1536:Jy7hMnfFfacHNfwoix3sJBsipZiZfJYd42+:JehMnflxBwlipP

Score
9/10
discovery

Malware Config

Signatures

  • Contacts a large (117974) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder 1 TTPs 2 IoCs
  • Changes its process name 1 IoCs

Processes

  • /tmp/jew.mpsl.elf
    /tmp/jew.mpsl.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Changes its process name
    PID:703

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Hijack Execution Flow

1
T1574

Privilege Escalation

Hijack Execution Flow

1
T1574

Defense Evasion

Impair Defenses

1
T1562

Hijack Execution Flow

1
T1574

Credential Access

Discovery

Network Service Discovery

2
T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads