30172d104f169e40b336c7cecc0c49dc68de35d2b8f53eee798e21679a076252 | Triage

Analysis

max time kernel
149s
max time network
144s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
16-12-2024 09:24

Sharing

Report Analysis Logs

General

Target

main_mpsl.elf
Size

173KB
MD5

386df114047250484c5fa6735fffef65
SHA1

9da85e4b39200e9d4c62c268b5da822dbffe2c51
SHA256

30172d104f169e40b336c7cecc0c49dc68de35d2b8f53eee798e21679a076252
SHA512

f384c714cea84185007180f0dd3689feb1949994f527d7152b533154976535b74cf18222dfa5d049cd315a2debd51a192faf7f76c8b0b03abe6c61b39380371c
SSDEEP

3072:nKpzG1eNkSfcQqmav8SqaRVlnYz65dVt:nKY1eNYQqmeqavlg65d

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
716	main_mpsl.elf

Traces itself 2 IoCs

Traces itself to prevent debugging attempts

pid	Process
716	main_mpsl.elf
717	main_mpsl.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	httpd	716	main_mpsl.elf

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/main_mpsl.elf	main_mpsl.elf

/tmp/main_mpsl.elf
/tmp/main_mpsl.elf
1⤵
- Deletes itself
- Traces itself
- Changes its process name
- Writes file to tmp directory
PID:716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads