Analysis
-
max time kernel
150s -
max time network
154s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240226-en -
resource tags
-
submitted
06/12/2024, 05:13
General
-
Target
main_mpsl.elf
-
Size
66KB
-
MD5
56463306bc217c81a1446607d42d5be4
-
SHA1
2401ed5d94ca806eea81b77176e06b65f66e6c85
-
SHA256
36ebc80a54b2207b7aab6816afd82bc64c73e001a52c0f1009311bdaf1173d6d
-
SHA512
50827274f3a6f49bdc4da7058c95e8db3d160d945c766f6ade78bf1c463bdd982f641c78d423c22d51af99d83a946d08e1431d4d51ff9e15479b8ab188cb8b9d
-
SSDEEP
1536:4YMFVUqsunVIJMLzGvs3O1bukj6WcZVC0gr:4Qqs8VIJMLyvyWcG
Malware Config
Signatures
-
Contacts a large (55275) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 44 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/main_mpsl.elf/tmp/main_mpsl.elf1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information