Analysis
-
max time kernel
134s -
max time network
136s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240729-en -
resource tags
arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
07/03/2025, 13:57
Behavioral task
behavioral1
Sample
blah.mpsl.elf
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
3 signatures
150 seconds
General
-
Target
blah.mpsl.elf
-
Size
59KB
-
MD5
24022994585fa2ac7bc207eff6a29a09
-
SHA1
3642c9108c284c0d545620b465afd8ceee28b7cb
-
SHA256
ae40589ca011bbeeab71412a1d1ecaab9a8f5757815c11832a1cb775691d8b58
-
SHA512
fe500a82f367181321262f9f7ef9b3c3cf97f52c6dbeeb51a07fde5c86300d772853ff552b6b3f93c3b664542b9a15a87aea4183dc118f3c3581bc7db7162cfa
-
SSDEEP
768:jQ0mOKvxcYm8WFUvw5xReSjer2gGZVxyXi6AL2Bj/9w:jQ0mp5ykwxTjY2tZVxz2Be
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a 708 blah.mpsl.elf -
description ioc Process File opened for reading /proc/324/cmdline blah.mpsl.elf File opened for reading /proc/344/cmdline blah.mpsl.elf File opened for reading /proc/345/cmdline blah.mpsl.elf File opened for reading /proc/386/cmdline blah.mpsl.elf File opened for reading /proc/677/cmdline blah.mpsl.elf File opened for reading /proc/700/cmdline blah.mpsl.elf File opened for reading /proc/703/cmdline blah.mpsl.elf File opened for reading /proc/2/cmdline blah.mpsl.elf File opened for reading /proc/80/cmdline blah.mpsl.elf File opened for reading /proc/109/cmdline blah.mpsl.elf File opened for reading /proc/347/cmdline blah.mpsl.elf File opened for reading /proc/379/cmdline blah.mpsl.elf File opened for reading /proc/8/cmdline blah.mpsl.elf File opened for reading /proc/6/cmdline blah.mpsl.elf File opened for reading /proc/7/cmdline blah.mpsl.elf File opened for reading /proc/13/cmdline blah.mpsl.elf File opened for reading /proc/14/cmdline blah.mpsl.elf File opened for reading /proc/16/cmdline blah.mpsl.elf File opened for reading /proc/18/cmdline blah.mpsl.elf File opened for reading /proc/73/cmdline blah.mpsl.elf File opened for reading /proc/126/cmdline blah.mpsl.elf File opened for reading /proc/684/cmdline blah.mpsl.elf File opened for reading /proc/705/cmdline blah.mpsl.elf File opened for reading /proc/706/cmdline blah.mpsl.elf File opened for reading /proc/12/cmdline blah.mpsl.elf File opened for reading /proc/70/cmdline blah.mpsl.elf File opened for reading /proc/179/cmdline blah.mpsl.elf File opened for reading /proc/679/cmdline blah.mpsl.elf File opened for reading /proc/10/cmdline blah.mpsl.elf File opened for reading /proc/37/cmdline blah.mpsl.elf File opened for reading /proc/71/cmdline blah.mpsl.elf File opened for reading /proc/685/cmdline blah.mpsl.elf File opened for reading /proc/717/cmdline blah.mpsl.elf File opened for reading /proc/9/cmdline blah.mpsl.elf File opened for reading /proc/15/cmdline blah.mpsl.elf File opened for reading /proc/21/cmdline blah.mpsl.elf File opened for reading /proc/74/cmdline blah.mpsl.elf File opened for reading /proc/75/cmdline blah.mpsl.elf File opened for reading /proc/76/cmdline blah.mpsl.elf File opened for reading /proc/77/cmdline blah.mpsl.elf File opened for reading /proc/157/cmdline blah.mpsl.elf File opened for reading /proc/17/cmdline blah.mpsl.elf File opened for reading /proc/22/cmdline blah.mpsl.elf File opened for reading /proc/23/cmdline blah.mpsl.elf File opened for reading /proc/707/cmdline blah.mpsl.elf File opened for reading /proc/72/cmdline blah.mpsl.elf File opened for reading /proc/82/cmdline blah.mpsl.elf File opened for reading /proc/1/cmdline blah.mpsl.elf File opened for reading /proc/178/cmdline blah.mpsl.elf File opened for reading /proc/349/cmdline blah.mpsl.elf File opened for reading /proc/470/cmdline blah.mpsl.elf File opened for reading /proc/19/cmdline blah.mpsl.elf File opened for reading /proc/20/cmdline blah.mpsl.elf File opened for reading /proc/36/cmdline blah.mpsl.elf File opened for reading /proc/158/cmdline blah.mpsl.elf File opened for reading /proc/674/cmdline blah.mpsl.elf File opened for reading /proc/5/cmdline blah.mpsl.elf File opened for reading /proc/235/cmdline blah.mpsl.elf File opened for reading /proc/374/cmdline blah.mpsl.elf File opened for reading /proc/4/cmdline blah.mpsl.elf File opened for reading /proc/701/cmdline blah.mpsl.elf File opened for reading /proc/3/cmdline blah.mpsl.elf File opened for reading /proc/11/cmdline blah.mpsl.elf File opened for reading /proc/24/cmdline blah.mpsl.elf