Analysis
-
max time kernel
127s -
max time network
163s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
10/03/2025, 01:52
Behavioral task
behavioral1
Sample
nklmpsl.elf
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
8 signatures
150 seconds
General
-
Target
nklmpsl.elf
-
Size
67KB
-
MD5
8b0befb4dc3bcd729a1532e8a1833e09
-
SHA1
908733bf3cc880b09386a578d9c3d62dbd0163fa
-
SHA256
fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f
-
SHA512
0da0f3fd3c691f0d7b19977962961f4e6cdcc42bde47ac8fdc087e91c9fc0eb660c0b764b7a9a8b293cc1296065ef3a39cb1f83af4f72b3f407837cf4d019b1d
-
SSDEEP
768:/5FfwfG+uy2OM1mLsaJjvTXk02XFo08OoB5EzeLneZReggk1Lt2KXiWUrzkW:/5FIe+uyBMQE97oBqqncRVgk1LE7z
Score
9/10
Malware Config
Signatures
-
Contacts a large (151182) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nklmpsl.elf File opened for modification /dev/misc/watchdog nklmpsl.elf -
Renames itself 1 IoCs
pid Process 742 nklmpsl.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 202.61.197.122 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself systemd 742 nklmpsl.elf -
description ioc Process File opened for reading /proc/13/comm nklmpsl.elf File opened for reading /proc/24/comm nklmpsl.elf File opened for reading /proc/25/comm nklmpsl.elf File opened for reading /proc/27/comm nklmpsl.elf File opened for reading /proc/42/comm nklmpsl.elf File opened for reading /proc/116/comm nklmpsl.elf File opened for reading /proc/411/comm nklmpsl.elf File opened for reading /proc/599/comm nklmpsl.elf File opened for reading /proc/3/comm nklmpsl.elf File opened for reading /proc/17/comm nklmpsl.elf File opened for reading /proc/34/comm nklmpsl.elf File opened for reading /proc/693/comm nklmpsl.elf File opened for reading /proc/713/comm nklmpsl.elf File opened for reading /proc/2/comm nklmpsl.elf File opened for reading /proc/4/comm nklmpsl.elf File opened for reading /proc/58/comm nklmpsl.elf File opened for reading /proc/390/comm nklmpsl.elf File opened for reading /proc/690/comm nklmpsl.elf File opened for reading /proc/12/comm nklmpsl.elf File opened for reading /proc/14/comm nklmpsl.elf File opened for reading /proc/35/comm nklmpsl.elf File opened for reading /proc/48/comm nklmpsl.elf File opened for reading /proc/59/comm nklmpsl.elf File opened for reading /proc/203/comm nklmpsl.elf File opened for reading /proc/392/comm nklmpsl.elf File opened for reading /proc/691/comm nklmpsl.elf File opened for reading /proc/23/comm nklmpsl.elf File opened for reading /proc/28/comm nklmpsl.elf File opened for reading /proc/53/comm nklmpsl.elf File opened for reading /proc/138/comm nklmpsl.elf File opened for reading /proc/717/comm nklmpsl.elf File opened for reading /proc/732/comm nklmpsl.elf File opened for reading /proc/16/comm nklmpsl.elf File opened for reading /proc/21/comm nklmpsl.elf File opened for reading /proc/26/comm nklmpsl.elf File opened for reading /proc/33/comm nklmpsl.elf File opened for reading /proc/119/comm nklmpsl.elf File opened for reading /proc/180/comm nklmpsl.elf File opened for reading /proc/334/comm nklmpsl.elf File opened for reading /proc/410/comm nklmpsl.elf File opened for reading /proc/600/comm nklmpsl.elf File opened for reading /proc/1/comm nklmpsl.elf File opened for reading /proc/11/comm nklmpsl.elf File opened for reading /proc/15/comm nklmpsl.elf File opened for reading /proc/47/comm nklmpsl.elf File opened for reading /proc/137/comm nklmpsl.elf File opened for reading /proc/9/comm nklmpsl.elf File opened for reading /proc/19/comm nklmpsl.elf File opened for reading /proc/32/comm nklmpsl.elf File opened for reading /proc/114/comm nklmpsl.elf File opened for reading /proc/737/comm nklmpsl.elf File opened for reading /proc/18/comm nklmpsl.elf File opened for reading /proc/22/comm nklmpsl.elf File opened for reading /proc/29/comm nklmpsl.elf File opened for reading /proc/406/comm nklmpsl.elf File opened for reading /proc/30/comm nklmpsl.elf File opened for reading /proc/115/comm nklmpsl.elf File opened for reading /proc/403/comm nklmpsl.elf File opened for reading /proc/329/comm nklmpsl.elf File opened for reading /proc/733/comm nklmpsl.elf File opened for reading /proc/5/comm nklmpsl.elf File opened for reading /proc/7/comm nklmpsl.elf File opened for reading /proc/45/comm nklmpsl.elf File opened for reading /proc/113/comm nklmpsl.elf