Analysis
-
max time kernel
150s -
max time network
152s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240729-en -
resource tags
arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
13-12-2024 09:19
Behavioral task
behavioral1
Sample
byte.mpsl.elf
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
3 signatures
150 seconds
General
-
Target
byte.mpsl.elf
-
Size
118KB
-
MD5
034bae419c844c89b42d2b39200d15ca
-
SHA1
3cfaf658fc0bf57fd431c430693cff7a342781bc
-
SHA256
07436ba06220ede5338f7f770e7c6a660f11e3bbebba6c92d5988d5f512b4983
-
SHA512
a08cc0ec6b0012dd5b816b0ea12773b289a80ed8322751c855d71b9aa397f8193c0db3f1b193e92f1ac80b23a6dc02ddbfa9d730cb220e23fa54534653ab0083
-
SSDEEP
1536:BGmnLpEKrHc9o8uGC9KF86e//F7ogl/f4ZLpL35FstAPeemQSl61d6vZgum:RLuKrHc3Cd5ln4vRaQS44Zg
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog byte.mpsl.elf File opened for modification /dev/misc/watchdog byte.mpsl.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/37/cmdline byte.mpsl.elf File opened for reading /proc/767/net/tcp byte.mpsl.elf File opened for reading /proc/773/cmdline byte.mpsl.elf File opened for reading /proc/770/net/tcp byte.mpsl.elf File opened for reading /proc/780/cmdline byte.mpsl.elf File opened for reading /proc/819/cmdline byte.mpsl.elf File opened for reading /proc/13/cmdline byte.mpsl.elf File opened for reading /proc/110/cmdline byte.mpsl.elf File opened for reading /proc/714/cmdline byte.mpsl.elf File opened for reading /proc/809/cmdline byte.mpsl.elf File opened for reading /proc/713/cmdline byte.mpsl.elf File opened for reading /proc/753/net/tcp byte.mpsl.elf File opened for reading /proc/762/net/tcp byte.mpsl.elf File opened for reading /proc/767/cmdline byte.mpsl.elf File opened for reading /proc/781/cmdline byte.mpsl.elf File opened for reading /proc/817/net/tcp byte.mpsl.elf File opened for reading /proc/78/cmdline byte.mpsl.elf File opened for reading /proc/758/net/tcp byte.mpsl.elf File opened for reading /proc/774/cmdline byte.mpsl.elf File opened for reading /proc/162/cmdline byte.mpsl.elf File opened for reading /proc/672/cmdline byte.mpsl.elf File opened for reading /proc/791/cmdline byte.mpsl.elf File opened for reading /proc/810/cmdline byte.mpsl.elf File opened for reading /proc/748/cmdline byte.mpsl.elf File opened for reading /proc/749/net/tcp byte.mpsl.elf File opened for reading /proc/763/cmdline byte.mpsl.elf File opened for reading /proc/384/cmdline byte.mpsl.elf File opened for reading /proc/747/net/tcp byte.mpsl.elf File opened for reading /proc/748/net/tcp byte.mpsl.elf File opened for reading /proc/779/net/tcp byte.mpsl.elf File opened for reading /proc/825/cmdline byte.mpsl.elf File opened for reading /proc/10/cmdline byte.mpsl.elf File opened for reading /proc/781/net/tcp byte.mpsl.elf File opened for reading /proc/14/cmdline byte.mpsl.elf File opened for reading /proc/23/cmdline byte.mpsl.elf File opened for reading /proc/71/cmdline byte.mpsl.elf File opened for reading /proc/758/cmdline byte.mpsl.elf File opened for reading /proc/796/net/tcp byte.mpsl.elf File opened for reading /proc/802/net/tcp byte.mpsl.elf File opened for reading /proc/816/cmdline byte.mpsl.elf File opened for reading /proc/443/cmdline byte.mpsl.elf File opened for reading /proc/735/cmdline byte.mpsl.elf File opened for reading /proc/743/net/tcp byte.mpsl.elf File opened for reading /proc/751/cmdline byte.mpsl.elf File opened for reading /proc/155/net/tcp byte.mpsl.elf File opened for reading /proc/127/cmdline byte.mpsl.elf File opened for reading /proc/739/net/tcp byte.mpsl.elf File opened for reading /proc/724/net/tcp byte.mpsl.elf File opened for reading /proc/768/net/tcp byte.mpsl.elf File opened for reading /proc/780/net/tcp byte.mpsl.elf File opened for reading /proc/805/cmdline byte.mpsl.elf File opened for reading /proc/823/cmdline byte.mpsl.elf File opened for reading /proc/810/exe byte.mpsl.elf File opened for reading /proc/819/net/tcp byte.mpsl.elf File opened for reading /proc/723/net/tcp byte.mpsl.elf File opened for reading /proc/736/net/tcp byte.mpsl.elf File opened for reading /proc/775/cmdline byte.mpsl.elf File opened for reading /proc/779/cmdline byte.mpsl.elf File opened for reading /proc/785/cmdline byte.mpsl.elf File opened for reading /proc/790/net/tcp byte.mpsl.elf File opened for reading /proc/815/cmdline byte.mpsl.elf File opened for reading /proc/36/cmdline byte.mpsl.elf File opened for reading /proc/786/net/tcp byte.mpsl.elf File opened for reading /proc/800/cmdline byte.mpsl.elf