Analysis
-
max time kernel
151s -
max time network
151s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
25-12-2024 11:42
Behavioral task
behavioral1
Sample
mpsl.elf
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
4 signatures
150 seconds
General
-
Target
mpsl.elf
-
Size
117KB
-
MD5
2fa5009f80187eab71c713eeddf85930
-
SHA1
9b93b360681885aa3de34968be730153f9e0b723
-
SHA256
a5f606e048e29abe87aa06941369dcd89e4d0e47d345d3df621f43ba5de84dad
-
SHA512
002b5a5804e0093bf745e43b2ff177c240d8d1669b5202c38a3ed04c04570d5344d2807f2b44b56fdddd259cef977f86fc130a51ef2aa27ebadaf0a328137e14
-
SSDEEP
1536:MLBhZQZyzqUvfXPZ3F8KG+7uCUlj138W1F0AhjsnpahhH7ci:MLBDYyzqUv/FFyj1MW1Ceonp07X
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 739 mpsl.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 4 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself nginx 742 mpsl.elf Changes the process name, possibly in an attempt to hide itself bash 740 mpsl.elf Changes the process name, possibly in an attempt to hide itself inetd 743 mpsl.elf Changes the process name, possibly in an attempt to hide itself sshd 744 mpsl.elf -
description ioc Process File opened for reading /proc/137/cmdline mpsl.elf File opened for reading /proc/201/cmdline mpsl.elf File opened for reading /proc/1/cmdline mpsl.elf File opened for reading /proc/9/cmdline mpsl.elf File opened for reading /proc/10/cmdline mpsl.elf File opened for reading /proc/11/cmdline mpsl.elf File opened for reading /proc/13/cmdline mpsl.elf File opened for reading /proc/45/cmdline mpsl.elf File opened for reading /proc/374/cmdline mpsl.elf File opened for reading /proc/717/cmdline mpsl.elf File opened for reading /proc/21/cmdline mpsl.elf File opened for reading /proc/25/cmdline mpsl.elf File opened for reading /proc/48/cmdline mpsl.elf File opened for reading /proc/53/cmdline mpsl.elf File opened for reading /proc/2/cmdline mpsl.elf File opened for reading /proc/17/cmdline mpsl.elf File opened for reading /proc/20/cmdline mpsl.elf File opened for reading /proc/59/cmdline mpsl.elf File opened for reading /proc/247/cmdline mpsl.elf File opened for reading /proc/730/cmdline mpsl.elf File opened for reading /proc/12/cmdline mpsl.elf File opened for reading /proc/22/cmdline mpsl.elf File opened for reading /proc/28/cmdline mpsl.elf File opened for reading /proc/391/cmdline mpsl.elf File opened for reading /proc/668/cmdline mpsl.elf File opened for reading /proc/19/cmdline mpsl.elf File opened for reading /proc/34/cmdline mpsl.elf File opened for reading /proc/42/cmdline mpsl.elf File opened for reading /proc/47/cmdline mpsl.elf File opened for reading /proc/744/cmdline mpsl.elf File opened for reading /proc/31/cmdline mpsl.elf File opened for reading /proc/111/cmdline mpsl.elf File opened for reading /proc/112/cmdline mpsl.elf File opened for reading /proc/711/cmdline mpsl.elf File opened for reading /proc/16/cmdline mpsl.elf File opened for reading /proc/24/cmdline mpsl.elf File opened for reading /proc/30/cmdline mpsl.elf File opened for reading /proc/680/cmdline mpsl.elf File opened for reading /proc/731/cmdline mpsl.elf File opened for reading /proc/414/cmdline mpsl.elf File opened for reading /proc/666/cmdline mpsl.elf File opened for reading /proc/3/cmdline mpsl.elf File opened for reading /proc/6/cmdline mpsl.elf File opened for reading /proc/23/cmdline mpsl.elf File opened for reading /proc/37/cmdline mpsl.elf File opened for reading /proc/136/cmdline mpsl.elf File opened for reading /proc/363/cmdline mpsl.elf File opened for reading /proc/27/cmdline mpsl.elf File opened for reading /proc/33/cmdline mpsl.elf File opened for reading /proc/58/cmdline mpsl.elf File opened for reading /proc/743/cmdline mpsl.elf File opened for reading /proc/5/cmdline mpsl.elf File opened for reading /proc/390/cmdline mpsl.elf File opened for reading /proc/679/cmdline mpsl.elf File opened for reading /proc/695/cmdline mpsl.elf File opened for reading /proc/118/cmdline mpsl.elf File opened for reading /proc/375/cmdline mpsl.elf File opened for reading /proc/387/cmdline mpsl.elf File opened for reading /proc/741/cmdline mpsl.elf File opened for reading /proc/733/cmdline mpsl.elf File opened for reading /proc/18/cmdline mpsl.elf File opened for reading /proc/26/cmdline mpsl.elf File opened for reading /proc/35/cmdline mpsl.elf File opened for reading /proc/384/cmdline mpsl.elf