Analysis
-
max time kernel
70s -
max time network
154s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240611-en -
resource tags
-
submitted
19-02-2025 18:52
General
-
Target
jade.mpsl.elf
-
Size
99KB
-
MD5
c5edfb455bd4a94a5840f1fa0e2a06a5
-
SHA1
7d2b5a8f293510b5a1d2ea60f6c9724548204290
-
SHA256
d85ee3efae8a847b91a5b275c117dce30e7ccfd53ccfbfc7c98b4abd650d3099
-
SHA512
e150eb8498a230bbf1ea806c6eaa84a150bb9d2a1d43340990a90cb166148277921b4c6dad939f5d1c6dad18427f2750a223d767dabf2960ba6f077dc9cfbb47
-
SSDEEP
1536:9kkdyTy3yryaidLVeMLW96qzEx52rRlspIwVjDZiLcTN5k3:9kk0UMSJ9WwoEXqWjDQ
Malware Config
Signatures
-
Contacts a large (171360) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 42 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/jade.mpsl.elf/tmp/jade.mpsl.elf1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information