Analysis
-
max time kernel
152s -
max time network
163s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
27-12-2024 13:12
Behavioral task
behavioral1
Sample
byte.mpsl.elf
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
3 signatures
150 seconds
General
-
Target
byte.mpsl.elf
-
Size
106KB
-
MD5
5eb2edce17e55a31ffa388ae08ba6245
-
SHA1
79f5b95ccb89ec9375e083e2e78d8cffa107ab40
-
SHA256
6af1aed67c38f6e2a207c731347ecb984d8545ea7d2a4e2811f3e81702b3a889
-
SHA512
3dab64074597cd55ace8ba99c8f117fef32bedc4ae1376d7388d3122a5f297b4290a854329d34967fdcbcedddbecddc0aa1cf4503352ab70be38f84a2b9215a4
-
SSDEEP
1536:EiuIJqfyQd84UB/Qc857JAZ559xWcfZcKalcMbl61d6kGGflDa:/ugqfyQdDu59jfpo4HGO1a
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog byte.mpsl.elf File opened for modification /dev/misc/watchdog byte.mpsl.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/746/cmdline byte.mpsl.elf File opened for reading /proc/775/cmdline byte.mpsl.elf File opened for reading /proc/805/cmdline byte.mpsl.elf File opened for reading /proc/821/cmdline byte.mpsl.elf File opened for reading /proc/909/cmdline byte.mpsl.elf File opened for reading /proc/910/cmdline byte.mpsl.elf File opened for reading /proc/431/cmdline byte.mpsl.elf File opened for reading /proc/793/cmdline byte.mpsl.elf File opened for reading /proc/798/cmdline byte.mpsl.elf File opened for reading /proc/825/cmdline byte.mpsl.elf File opened for reading /proc/835/cmdline byte.mpsl.elf File opened for reading /proc/861/cmdline byte.mpsl.elf File opened for reading /proc/180/cmdline byte.mpsl.elf File opened for reading /proc/754/cmdline byte.mpsl.elf File opened for reading /proc/808/cmdline byte.mpsl.elf File opened for reading /proc/885/cmdline byte.mpsl.elf File opened for reading /proc/19/cmdline byte.mpsl.elf File opened for reading /proc/816/cmdline byte.mpsl.elf File opened for reading /proc/859/cmdline byte.mpsl.elf File opened for reading /proc/902/cmdline byte.mpsl.elf File opened for reading /proc/925/cmdline byte.mpsl.elf File opened for reading /proc/933/cmdline byte.mpsl.elf File opened for reading /proc/764/cmdline byte.mpsl.elf File opened for reading /proc/839/cmdline byte.mpsl.elf File opened for reading /proc/878/cmdline byte.mpsl.elf File opened for reading /proc/886/cmdline byte.mpsl.elf File opened for reading /proc/896/cmdline byte.mpsl.elf File opened for reading /proc/928/cmdline byte.mpsl.elf File opened for reading /proc/16/cmdline byte.mpsl.elf File opened for reading /proc/763/cmdline byte.mpsl.elf File opened for reading /proc/916/cmdline byte.mpsl.elf File opened for reading /proc/752/cmdline byte.mpsl.elf File opened for reading /proc/806/cmdline byte.mpsl.elf File opened for reading /proc/939/cmdline byte.mpsl.elf File opened for reading /proc/791/cmdline byte.mpsl.elf File opened for reading /proc/809/cmdline byte.mpsl.elf File opened for reading /proc/815/cmdline byte.mpsl.elf File opened for reading /proc/828/cmdline byte.mpsl.elf File opened for reading /proc/911/cmdline byte.mpsl.elf File opened for reading /proc/918/cmdline byte.mpsl.elf File opened for reading /proc/940/cmdline byte.mpsl.elf File opened for reading /proc/873/cmdline byte.mpsl.elf File opened for reading /proc/5/cmdline byte.mpsl.elf File opened for reading /proc/37/cmdline byte.mpsl.elf File opened for reading /proc/622/cmdline byte.mpsl.elf File opened for reading /proc/784/cmdline byte.mpsl.elf File opened for reading /proc/810/cmdline byte.mpsl.elf File opened for reading /proc/826/cmdline byte.mpsl.elf File opened for reading /proc/847/cmdline byte.mpsl.elf File opened for reading /proc/877/cmdline byte.mpsl.elf File opened for reading /proc/908/cmdline byte.mpsl.elf File opened for reading /proc/12/cmdline byte.mpsl.elf File opened for reading /proc/53/cmdline byte.mpsl.elf File opened for reading /proc/324/cmdline byte.mpsl.elf File opened for reading /proc/391/cmdline byte.mpsl.elf File opened for reading /proc/802/cmdline byte.mpsl.elf File opened for reading /proc/887/cmdline byte.mpsl.elf File opened for reading /proc/892/cmdline byte.mpsl.elf File opened for reading /proc/905/cmdline byte.mpsl.elf File opened for reading /proc/1/cmdline byte.mpsl.elf File opened for reading /proc/22/cmdline byte.mpsl.elf File opened for reading /proc/31/cmdline byte.mpsl.elf File opened for reading /proc/780/cmdline byte.mpsl.elf File opened for reading /proc/845/cmdline byte.mpsl.elf