Analysis
-
max time kernel
149s -
max time network
149s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240729-en -
resource tags
arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
16-01-2025 04:47
Behavioral task
behavioral1
Sample
byte.mpsl.elf
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
3 signatures
150 seconds
General
-
Target
byte.mpsl.elf
-
Size
106KB
-
MD5
9f633af26340c41a2c83991aaa2bde7b
-
SHA1
5da88f9eb86ae8b08af2919562bd23a890f14491
-
SHA256
7ad608b962bf416701237910ed46e71e4c5acae37f0c9c0c8e7ff29d07a9b0df
-
SHA512
48716eca7e7b4328fc2328bff0607a5ec2817b4d87575c53e6557c34de8923524e866764519e284547f3a0212568f912e5ab4709c7b99c676f1a9dd71026f9ab
-
SSDEEP
1536:jyuo5zfiQN84/eR+QMBpx5AJltiwsGZMaKVHM7l61d6Om2flDH:2uQzfiQNd6tcGCQ4Jm+1H
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog byte.mpsl.elf File opened for modification /dev/misc/watchdog byte.mpsl.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/12/cmdline byte.mpsl.elf File opened for reading /proc/155/cmdline byte.mpsl.elf File opened for reading /proc/252/cmdline byte.mpsl.elf File opened for reading /proc/719/cmdline byte.mpsl.elf File opened for reading /proc/798/cmdline byte.mpsl.elf File opened for reading /proc/4/cmdline byte.mpsl.elf File opened for reading /proc/19/cmdline byte.mpsl.elf File opened for reading /proc/75/cmdline byte.mpsl.elf File opened for reading /proc/726/cmdline byte.mpsl.elf File opened for reading /proc/8/cmdline byte.mpsl.elf File opened for reading /proc/74/cmdline byte.mpsl.elf File opened for reading /proc/382/cmdline byte.mpsl.elf File opened for reading /proc/730/cmdline byte.mpsl.elf File opened for reading /proc/749/cmdline byte.mpsl.elf File opened for reading /proc/791/cmdline byte.mpsl.elf File opened for reading /proc/71/cmdline byte.mpsl.elf File opened for reading /proc/36/cmdline byte.mpsl.elf File opened for reading /proc/381/cmdline byte.mpsl.elf File opened for reading /proc/734/cmdline byte.mpsl.elf File opened for reading /proc/794/cmdline byte.mpsl.elf File opened for reading /proc/801/cmdline byte.mpsl.elf File opened for reading /proc/2/cmdline byte.mpsl.elf File opened for reading /proc/82/cmdline byte.mpsl.elf File opened for reading /proc/759/cmdline byte.mpsl.elf File opened for reading /proc/779/cmdline byte.mpsl.elf File opened for reading /proc/23/cmdline byte.mpsl.elf File opened for reading /proc/371/cmdline byte.mpsl.elf File opened for reading /proc/728/cmdline byte.mpsl.elf File opened for reading /proc/740/cmdline byte.mpsl.elf File opened for reading /proc/767/cmdline byte.mpsl.elf File opened for reading /proc/789/cmdline byte.mpsl.elf File opened for reading /proc/795/cmdline byte.mpsl.elf File opened for reading /proc/336/cmdline byte.mpsl.elf File opened for reading /proc/11/cmdline byte.mpsl.elf File opened for reading /proc/81/cmdline byte.mpsl.elf File opened for reading /proc/120/cmdline byte.mpsl.elf File opened for reading /proc/159/cmdline byte.mpsl.elf File opened for reading /proc/729/cmdline byte.mpsl.elf File opened for reading /proc/744/cmdline byte.mpsl.elf File opened for reading /proc/787/cmdline byte.mpsl.elf File opened for reading /proc/7/cmdline byte.mpsl.elf File opened for reading /proc/70/cmdline byte.mpsl.elf File opened for reading /proc/72/cmdline byte.mpsl.elf File opened for reading /proc/678/cmdline byte.mpsl.elf File opened for reading /proc/17/cmdline byte.mpsl.elf File opened for reading /proc/773/cmdline byte.mpsl.elf File opened for reading /proc/780/cmdline byte.mpsl.elf File opened for reading /proc/711/cmdline byte.mpsl.elf File opened for reading /proc/388/cmdline byte.mpsl.elf File opened for reading /proc/14/cmdline byte.mpsl.elf File opened for reading /proc/24/cmdline byte.mpsl.elf File opened for reading /proc/76/cmdline byte.mpsl.elf File opened for reading /proc/22/cmdline byte.mpsl.elf File opened for reading /proc/715/cmdline byte.mpsl.elf File opened for reading /proc/717/cmdline byte.mpsl.elf File opened for reading /proc/800/cmdline byte.mpsl.elf File opened for reading /proc/3/cmdline byte.mpsl.elf File opened for reading /proc/121/cmdline byte.mpsl.elf File opened for reading /proc/716/cmdline byte.mpsl.elf File opened for reading /proc/737/cmdline byte.mpsl.elf File opened for reading /proc/804/cmdline byte.mpsl.elf File opened for reading /proc/109/cmdline byte.mpsl.elf File opened for reading /proc/175/cmdline byte.mpsl.elf File opened for reading /proc/796/cmdline byte.mpsl.elf