3f641d453df7285ffdc7cb3eb2e4c2b8ed3c4ccfeee6600626c90a7bdc8c6046

Analysis

max time kernel
29s
max time network
22s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
31/12/2024, 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mpsl.elf
Size

106KB
MD5

e1506e7d4d7359db685b3bdef09a1de9
SHA1

73232a78e75d724d56455562c84684389450e881
SHA256

3f641d453df7285ffdc7cb3eb2e4c2b8ed3c4ccfeee6600626c90a7bdc8c6046
SHA512

2f0dac784c12d407a4b4412dc8bba251a06cae2b64298d062cb2f68bc0651559d59f4ce9ddf309c63c53e118b25e78f042b979ca74926244d57204f3dccdfbd9
SSDEEP

1536:xpkGXvSvr77wIPSdCAWdVixkxhWf3jQ0wZygsCkcmRv2:xpk4Svr77wG8vj5wnev2

Score

7^/10

defense_evasion discovery evasion persistence privilege_escalation

Malware Config

Signatures

Deletes Audit logs 1 TTPs 1 IoCs

Deletes logs related to the Linux Audit framework.

evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/audit/audit.log	mpsl.elf

Deletes itself 1 IoCs

pid	Process
710	mpsl.elf

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/syslog	mpsl.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	mpsl.elf
File opened for modification	/dev/misc/watchdog	mpsl.elf

Deletes log files 1 TTPs 3 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/wtmp	mpsl.elf
File deleted	/var/log/auth.log	mpsl.elf
File deleted	/var/log/daemon.log	mpsl.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/startup_command.service	mpsl.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	c4ogpjkwm238hdugc6ur4mtv	710	mpsl.elf

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/81/cmdline	mpsl.elf
File opened for reading	/proc/709/cmdline	mpsl.elf
File opened for reading	/proc/3/cmdline	mpsl.elf
File opened for reading	/proc/36/cmdline	mpsl.elf
File opened for reading	/proc/708/cmdline	mpsl.elf
File opened for reading	/proc/756/cmdline	mpsl.elf
File opened for reading	/proc/707/cmdline	mpsl.elf
File opened for reading	/proc/5/cmdline	mpsl.elf
File opened for reading	/proc/18/cmdline	mpsl.elf
File opened for reading	/proc/73/cmdline	mpsl.elf
File opened for reading	/proc/233/cmdline	mpsl.elf
File opened for reading	/proc/678/cmdline	mpsl.elf
File opened for reading	/proc/10/cmdline	mpsl.elf
File opened for reading	/proc/14/cmdline	mpsl.elf
File opened for reading	/proc/70/cmdline	mpsl.elf
File opened for reading	/proc/329/cmdline	mpsl.elf
File opened for reading	/proc/20/cmdline	mpsl.elf
File opened for reading	/proc/37/cmdline	mpsl.elf
File opened for reading	/proc/74/cmdline	mpsl.elf
File opened for reading	/proc/386/cmdline	mpsl.elf
File opened for reading	/proc/814/cmdline	mpsl.elf
File opened for reading	/proc/362/cmdline	mpsl.elf
File opened for reading	/proc/6/cmdline	mpsl.elf
File opened for reading	/proc/8/cmdline	mpsl.elf
File opened for reading	/proc/13/cmdline	mpsl.elf
File opened for reading	/proc/76/cmdline	mpsl.elf
File opened for reading	/proc/155/cmdline	mpsl.elf
File opened for reading	/proc/703/cmdline	mpsl.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/cmdline	mpsl.elf
File opened for reading	/proc/4/cmdline	mpsl.elf
File opened for reading	/proc/23/cmdline	mpsl.elf
File opened for reading	/proc/359/cmdline	mpsl.elf
File opened for reading	/proc/382/cmdline	mpsl.elf
File opened for reading	/proc/249/cmdline	mpsl.elf
File opened for reading	/proc/331/cmdline	mpsl.elf
File opened for reading	/proc/434/cmdline	mpsl.elf
File opened for reading	/proc/675/cmdline	mpsl.elf
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/21/cmdline	mpsl.elf
File opened for reading	/proc/24/cmdline	mpsl.elf
File opened for reading	/proc/77/cmdline	mpsl.elf
File opened for reading	/proc/685/cmdline	mpsl.elf
File opened for reading	/proc/815/cmdline	mpsl.elf
File opened for reading	/proc/816/cmdline	mpsl.elf
File opened for reading	/proc/12/cmdline	mpsl.elf
File opened for reading	/proc/19/cmdline	mpsl.elf
File opened for reading	/proc/72/cmdline	mpsl.elf
File opened for reading	/proc/79/cmdline	mpsl.elf
File opened for reading	/proc/120/cmdline	mpsl.elf
File opened for reading	/proc/822/cmdline	mpsl.elf
File opened for reading	/proc/9/cmdline	mpsl.elf
File opened for reading	/proc/71/cmdline	mpsl.elf
File opened for reading	/proc/330/cmdline	mpsl.elf
File opened for reading	/proc/710/cmdline	mpsl.elf
File opened for reading	/proc/819/cmdline	mpsl.elf
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/2/cmdline	mpsl.elf
File opened for reading	/proc/7/cmdline	mpsl.elf
File opened for reading	/proc/384/cmdline	mpsl.elf
File opened for reading	/proc/716/cmdline	mpsl.elf
File opened for reading	/proc/812/cmdline	mpsl.elf
File opened for reading	/proc/121/cmdline	mpsl.elf
File opened for reading	/proc/160/cmdline	mpsl.elf

/tmp/mpsl.elf
/tmp/mpsl.elf
1⤵
- Deletes Audit logs
- Deletes itself
- Deletes system logs
- Modifies Watchdog functionality
- Deletes log files
- Modifies systemd
- Changes its process name
- Reads runtime system information
PID:710
- /bin/sh
  sh -c "for pid in \$(ls /proc | grep -E '^[0-9]+\$'); do grep -q '(deleted)' /proc/\$pid/maps && kill -9 \$pid || true; done;"
  2⤵
  PID:711
- - /bin/ls
    ls /proc
    3⤵
    - Reads runtime system information
    PID:714
- - /bin/grep
    grep -E "^[0-9]+\$"
    3⤵
    PID:715
- - /bin/grep
    grep -q "(deleted)" /proc/1/maps
    3⤵
    PID:718
- - /bin/grep
    grep -q "(deleted)" /proc/10/maps
    3⤵
    PID:722
- - /bin/grep
    grep -q "(deleted)" /proc/109/maps
    3⤵
    PID:724
- - /bin/grep
    grep -q "(deleted)" /proc/11/maps
    3⤵
    PID:727
- - /bin/grep
    grep -q "(deleted)" /proc/12/maps
    3⤵
    PID:729
- - /bin/grep
    grep -q "(deleted)" /proc/120/maps
    3⤵
    PID:732
- - /bin/grep
    grep -q "(deleted)" /proc/121/maps
    3⤵
    PID:734
- - /bin/grep
    grep -q "(deleted)" /proc/13/maps
    3⤵
    PID:737
- - /bin/grep
    grep -q "(deleted)" /proc/14/maps
    3⤵
    PID:740
- - /bin/grep
    grep -q "(deleted)" /proc/15/maps
    3⤵
    PID:742
- - /bin/grep
    grep -q "(deleted)" /proc/155/maps
    3⤵
    PID:744
- - /bin/grep
    grep -q "(deleted)" /proc/16/maps
    3⤵
    PID:745
- - /bin/grep
    grep -q "(deleted)" /proc/160/maps
    3⤵
    PID:747
- - /bin/grep
    grep -q "(deleted)" /proc/17/maps
    3⤵
    PID:748
- - /bin/grep
    grep -q "(deleted)" /proc/176/maps
    3⤵
    PID:750
- - /bin/grep
    grep -q "(deleted)" /proc/18/maps
    3⤵
    PID:751
- - /bin/grep
    grep -q "(deleted)" /proc/19/maps
    3⤵
    PID:753
- - /bin/grep
    grep -q "(deleted)" /proc/2/maps
    3⤵
    PID:755
- - /bin/grep
    grep -q "(deleted)" /proc/20/maps
    3⤵
    PID:757
- - /bin/grep
    grep -q "(deleted)" /proc/21/maps
    3⤵
    PID:758
- - /bin/grep
    grep -q "(deleted)" /proc/22/maps
    3⤵
    PID:759
- - /bin/grep
    grep -q "(deleted)" /proc/23/maps
    3⤵
    PID:761
- - /bin/grep
    grep -q "(deleted)" /proc/233/maps
    3⤵
    PID:762
- - /bin/grep
    grep -q "(deleted)" /proc/24/maps
    3⤵
    PID:763
- - /bin/grep
    grep -q "(deleted)" /proc/249/maps
    3⤵
    PID:764
- - /bin/grep
    grep -q "(deleted)" /proc/3/maps
    3⤵
    PID:766
- - /bin/grep
    grep -q "(deleted)" /proc/329/maps
    3⤵
    PID:767
- - /bin/grep
    grep -q "(deleted)" /proc/330/maps
    3⤵
    PID:768
- - /bin/grep
    grep -q "(deleted)" /proc/331/maps
    3⤵
    PID:769
- - /bin/grep
    grep -q "(deleted)" /proc/359/maps
    3⤵
    PID:770
- - /bin/grep
    grep -q "(deleted)" /proc/36/maps
    3⤵
    PID:771
- - /bin/grep
    grep -q "(deleted)" /proc/362/maps
    3⤵
    PID:772
- - /bin/grep
    grep -q "(deleted)" /proc/37/maps
    3⤵
    PID:773
- - /bin/grep
    grep -q "(deleted)" /proc/382/maps
    3⤵
    PID:774
- - /bin/grep
    grep -q "(deleted)" /proc/384/maps
    3⤵
    PID:775
- - /bin/grep
    grep -q "(deleted)" /proc/386/maps
    3⤵
    PID:776
- - /bin/grep
    grep -q "(deleted)" /proc/4/maps
    3⤵
    PID:777
- - /bin/grep
    grep -q "(deleted)" /proc/434/maps
    3⤵
    PID:778
- - /bin/grep
    grep -q "(deleted)" /proc/5/maps
    3⤵
    PID:779
- - /bin/grep
    grep -q "(deleted)" /proc/6/maps
    3⤵
    PID:780
- - /bin/grep
    grep -q "(deleted)" /proc/675/maps
    3⤵
    PID:781
- - /bin/grep
    grep -q "(deleted)" /proc/678/maps
    3⤵
    PID:782
- - /bin/grep
    grep -q "(deleted)" /proc/683/maps
    3⤵
    PID:783
- - /bin/grep
    grep -q "(deleted)" /proc/685/maps
    3⤵
    PID:784
- - /bin/grep
    grep -q "(deleted)" /proc/686/maps
    3⤵
    PID:785
- - /bin/grep
    grep -q "(deleted)" /proc/7/maps
    3⤵
    PID:786
- - /bin/grep
    grep -q "(deleted)" /proc/70/maps
    3⤵
    PID:787
- - /bin/grep
    grep -q "(deleted)" /proc/702/maps
    3⤵
    PID:788
- - /bin/grep
    grep -q "(deleted)" /proc/703/maps
    3⤵
    PID:789
- - /bin/grep
    grep -q "(deleted)" /proc/707/maps
    3⤵
    PID:790
- - /bin/grep
    grep -q "(deleted)" /proc/708/maps
    3⤵
    PID:791
- - /bin/grep
    grep -q "(deleted)" /proc/709/maps
    3⤵
    PID:792
- - /bin/grep
    grep -q "(deleted)" /proc/71/maps
    3⤵
    PID:793
- - /bin/grep
    grep -q "(deleted)" /proc/710/maps
    3⤵
    PID:794
- - /bin/grep
    grep -q "(deleted)" /proc/711/maps
    3⤵
    PID:795
- - /bin/grep
    grep -q "(deleted)" /proc/712/maps
    3⤵
    PID:796
- - /bin/grep
    grep -q "(deleted)" /proc/714/maps
    3⤵
    PID:797
- - /bin/grep
    grep -q "(deleted)" /proc/715/maps
    3⤵
    PID:798
- - /bin/grep
    grep -q "(deleted)" /proc/716/maps
    3⤵
    PID:799
- - /bin/grep
    grep -q "(deleted)" /proc/72/maps
    3⤵
    PID:800
- - /bin/grep
    grep -q "(deleted)" /proc/73/maps
    3⤵
    PID:801
- - /bin/grep
    grep -q "(deleted)" /proc/74/maps
    3⤵
    PID:802
- - /bin/grep
    grep -q "(deleted)" /proc/75/maps
    3⤵
    PID:803
- - /bin/grep
    grep -q "(deleted)" /proc/76/maps
    3⤵
    PID:804
- - /bin/grep
    grep -q "(deleted)" /proc/77/maps
    3⤵
    PID:805
- - /bin/grep
    grep -q "(deleted)" /proc/79/maps
    3⤵
    PID:806
- - /bin/grep
    grep -q "(deleted)" /proc/8/maps
    3⤵
    PID:807
- - /bin/grep
    grep -q "(deleted)" /proc/81/maps
    3⤵
    PID:808
- - /bin/grep
    grep -q "(deleted)" /proc/82/maps
    3⤵
    PID:809
- - /bin/grep
    grep -q "(deleted)" /proc/9/maps
    3⤵
    PID:810
- /bin/sh
  sh -c "systemctl daemon-reload"
  2⤵
  PID:814
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/systemd/system/startup_command.service

Filesize
361B

MD5
4d2c868f454b6c55731485cf0f886dc0

SHA1
032b125de0a28dcee8d8d25fbeeb56db7f403f04

SHA256
8c4ae1b82477698f3a8c273b439cb9079794afb8fc33cd4def854936ba37ea2c

SHA512
060b2413a0cb2dec0db059c190467b5cb0d76209effea4ae3de2701fa71429b811a6f7e11e813b26806cf72578d1f32b608a02a4ce670ec58b5b65433e3cf11d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads