Analysis
-
max time kernel
84s -
max time network
151s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240611-en -
resource tags
arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
07/03/2025, 12:23
Behavioral task
behavioral1
Sample
nabmpsl.elf
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
11 signatures
150 seconds
General
-
Target
nabmpsl.elf
-
Size
50KB
-
MD5
cf78540b269e6a19af9cddf8da7f95eb
-
SHA1
0a6d185ac409e36511605e9d056b8af7bbc40cdb
-
SHA256
b7816bfc9667a38481a05ed89f3d4d46d6f1a0ad7b4282c656982a3ede890e24
-
SHA512
8fc62d9eb56eb9bee26184edde19db7ae4123a4608b6192c38f1d71826733522713c09a8f35962e72cd7d2851a186bc19d1c320b977446f882a038bf602378fd
-
SSDEEP
768:EDQ6R57QYZlWZfFKfNGfdaz5gBelje2jeX6J6W2QDXi94Kt4L:EDQm57hP0FMgwjPjG6J6dQyt
Score
9/10
Malware Config
Signatures
-
Contacts a large (14694) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nabmpsl.elf File opened for modification /dev/misc/watchdog nabmpsl.elf -
Renames itself 1 IoCs
pid Process 698 nabmpsl.elf -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.53.15.127 Destination IP 152.53.15.127 Destination IP 152.53.15.127 Destination IP 152.53.15.127 Destination IP 152.53.15.127 Destination IP 168.235.111.72 -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp nabmpsl.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads process memory 1 TTPs 51 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/762/maps nabmpsl.elf File opened for reading /proc/784/maps nabmpsl.elf File opened for reading /proc/789/maps nabmpsl.elf File opened for reading /proc/797/maps nabmpsl.elf File opened for reading /proc/803/maps nabmpsl.elf File opened for reading /proc/763/maps nabmpsl.elf File opened for reading /proc/771/maps nabmpsl.elf File opened for reading /proc/756/maps nabmpsl.elf File opened for reading /proc/759/maps nabmpsl.elf File opened for reading /proc/744/maps nabmpsl.elf File opened for reading /proc/740/maps nabmpsl.elf File opened for reading /proc/743/maps nabmpsl.elf File opened for reading /proc/754/maps nabmpsl.elf File opened for reading /proc/775/maps nabmpsl.elf File opened for reading /proc/785/maps nabmpsl.elf File opened for reading /proc/734/maps nabmpsl.elf File opened for reading /proc/742/maps nabmpsl.elf File opened for reading /proc/750/maps nabmpsl.elf File opened for reading /proc/767/maps nabmpsl.elf File opened for reading /proc/779/maps nabmpsl.elf File opened for reading /proc/781/maps nabmpsl.elf File opened for reading /proc/787/maps nabmpsl.elf File opened for reading /proc/791/maps nabmpsl.elf File opened for reading /proc/747/maps nabmpsl.elf File opened for reading /proc/748/maps nabmpsl.elf File opened for reading /proc/732/maps nabmpsl.elf File opened for reading /proc/736/maps nabmpsl.elf File opened for reading /proc/753/maps nabmpsl.elf File opened for reading /proc/766/maps nabmpsl.elf File opened for reading /proc/768/maps nabmpsl.elf File opened for reading /proc/777/maps nabmpsl.elf File opened for reading /proc/752/maps nabmpsl.elf File opened for reading /proc/760/maps nabmpsl.elf File opened for reading /proc/793/maps nabmpsl.elf File opened for reading /proc/798/maps nabmpsl.elf File opened for reading /proc/799/maps nabmpsl.elf File opened for reading /proc/801/maps nabmpsl.elf File opened for reading /proc/758/maps nabmpsl.elf File opened for reading /proc/770/maps nabmpsl.elf File opened for reading /proc/746/maps nabmpsl.elf File opened for reading /proc/730/maps nabmpsl.elf File opened for reading /proc/737/maps nabmpsl.elf File opened for reading /proc/741/maps nabmpsl.elf File opened for reading /proc/783/maps nabmpsl.elf File opened for reading /proc/794/maps nabmpsl.elf File opened for reading /proc/780/maps nabmpsl.elf File opened for reading /proc/790/maps nabmpsl.elf File opened for reading /proc/795/maps nabmpsl.elf File opened for reading /proc/804/maps nabmpsl.elf File opened for reading /proc/808/maps nabmpsl.elf File opened for reading /proc/738/maps nabmpsl.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself ksmd 698 nabmpsl.elf -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp nabmpsl.elf -
description ioc Process File opened for reading /proc/661/comm nabmpsl.elf File opened for reading /proc/22/comm nabmpsl.elf File opened for reading /proc/775/cmdline nabmpsl.elf File opened for reading /proc/677/comm nabmpsl.elf File opened for reading /proc/331/status nabmpsl.elf File opened for reading /proc/669/status nabmpsl.elf File opened for reading /proc/4/comm nabmpsl.elf File opened for reading /proc/13/comm nabmpsl.elf File opened for reading /proc/17/comm nabmpsl.elf File opened for reading /proc/18/comm nabmpsl.elf File opened for reading /proc/20/comm nabmpsl.elf File opened for reading /proc/82/comm nabmpsl.elf File opened for reading /proc/677/status nabmpsl.elf File opened for reading /proc/756/cmdline nabmpsl.elf File opened for reading /proc/693/status nabmpsl.elf File opened for reading /proc/self/maps nabmpsl.elf File opened for reading /proc/763/cmdline nabmpsl.elf File opened for reading /proc/770/cmdline nabmpsl.elf File opened for reading /proc/779/cmdline nabmpsl.elf File opened for reading /proc/74/comm nabmpsl.elf File opened for reading /proc/81/comm nabmpsl.elf File opened for reading /proc/690/status nabmpsl.elf File opened for reading /proc/754/cmdline nabmpsl.elf File opened for reading /proc/2/comm nabmpsl.elf File opened for reading /proc/9/comm nabmpsl.elf File opened for reading /proc/15/comm nabmpsl.elf File opened for reading /proc/70/comm nabmpsl.elf File opened for reading /proc/77/comm nabmpsl.elf File opened for reading /proc/84/comm nabmpsl.elf File opened for reading /proc/366/comm nabmpsl.elf File opened for reading /proc/332/comm nabmpsl.elf File opened for reading /proc/738/cmdline nabmpsl.elf File opened for reading /proc/760/cmdline nabmpsl.elf File opened for reading /proc/768/cmdline nabmpsl.elf File opened for reading /proc/336/comm nabmpsl.elf File opened for reading /proc/664/comm nabmpsl.elf File opened for reading /proc/330/status nabmpsl.elf File opened for reading /proc/691/status nabmpsl.elf File opened for reading /proc/741/cmdline nabmpsl.elf File opened for reading /proc/759/cmdline nabmpsl.elf File opened for reading /proc/7/comm nabmpsl.elf File opened for reading /proc/19/comm nabmpsl.elf File opened for reading /proc/72/comm nabmpsl.elf File opened for reading /proc/696/comm nabmpsl.elf File opened for reading /proc/364/status nabmpsl.elf File opened for reading /proc/750/cmdline nabmpsl.elf File opened for reading /proc/777/cmdline nabmpsl.elf File opened for reading /proc/791/cmdline nabmpsl.elf File opened for reading /proc/693/comm nabmpsl.elf File opened for reading /proc/164/status nabmpsl.elf File opened for reading /proc/471/status nabmpsl.elf File opened for reading /proc/670/status nabmpsl.elf File opened for reading /proc/730/cmdline nabmpsl.elf File opened for reading /proc/744/cmdline nabmpsl.elf File opened for reading /proc/1/comm nabmpsl.elf File opened for reading /proc/5/comm nabmpsl.elf File opened for reading /proc/10/comm nabmpsl.elf File opened for reading /proc/76/comm nabmpsl.elf File opened for reading /proc/378/status nabmpsl.elf File opened for reading /proc/661/status nabmpsl.elf File opened for reading /proc/780/cmdline nabmpsl.elf File opened for reading /proc/24/comm nabmpsl.elf File opened for reading /proc/37/comm nabmpsl.elf File opened for reading /proc/226/status nabmpsl.elf