11065f7356e62038d28f238f2901a3524a923fc7f5c76657fdcfeb03e14b287e

Analysis

max time kernel
1s
max time network
9s
platform
debian-12_mipsel
resource
debian12-mipsel-20240221-en
resource tags

arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
29-12-2024 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mpsel.elf
Size

134KB
MD5

b78275200139325f74582e5b1484be49
SHA1

3c44fb4173161e7c465cee960a6b3dac483b88b8
SHA256

11065f7356e62038d28f238f2901a3524a923fc7f5c76657fdcfeb03e14b287e
SHA512

74a6b8c073dd11fb8a7d0392711ca055fc1cc8309c4b37ae37618b34bf21db01225b4f6503a44735520da331e71bfa8f748b661abb54efc96029732f8b7048db
SSDEEP

1536:8g4reT9HLsNp17Osky8ZWqIX0Fbsbmo8iuHaI5hWt57gUUxOCfF3xuhmqY1fqjBX:8mLkkVICJOI5hW3mfF3xemqY1fuBmvm

Score

7^/10

Malware Config

Signatures

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/resolv.conf	mpsel.elf

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	741	mpsel.elf

/tmp/mpsel.elf
/tmp/mpsel.elf
1⤵
- Writes DNS configuration
- Changes its process name
PID:741

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Adversary-in-the-Middle

T1557

Discovery

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads