Analysis
-
max time kernel
150s -
max time network
152s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240611-en -
resource tags
arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
01-07-2024 21:15
Behavioral task
behavioral1
Sample
jew.mpsl.elf
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
5 signatures
150 seconds
General
-
Target
jew.mpsl.elf
-
Size
86KB
-
MD5
ea1a69894f740cee70dabfe41b43230b
-
SHA1
2d3ac620a4904c1f33bf4848e493090c5fc8263a
-
SHA256
8bc2c42c5f38ecdcc9c3c1b630638d6cdae9c3a06ce4602b74d3e8ebff9a7f74
-
SHA512
dd7b19bb8efcfddff6ef70a724eb06326a9318474719390a542a8fb7a4fd540e1866486b40784214af78edacb0dfed6fda4d6fe6c1bc19557a08d908ec5aa2a6
-
SSDEEP
1536:Jy7hMnfFfacHNfwoix3sJBsipZiZfJYd42+:JehMnflxBwlipP
Score
9/10
Malware Config
Signatures
-
Contacts a large (117974) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
jew.mpsl.elfdescription ioc process File opened for modification /dev/misc/watchdog jew.mpsl.elf File opened for modification /dev/watchdog jew.mpsl.elf -
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
jew.mpsl.elfdescription ioc process File opened for modification /sbin/watchdog jew.mpsl.elf File opened for modification /bin/watchdog jew.mpsl.elf -
Changes its process name 1 IoCs
Processes:
jew.mpsl.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself miuvEdejrfsAamCE/= 703 jew.mpsl.elf