Analysis
-
max time kernel
153s -
max time network
161s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
10/03/2025, 01:57
Behavioral task
behavioral1
Sample
zermpsl.elf
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
6 signatures
150 seconds
General
-
Target
zermpsl.elf
-
Size
66KB
-
MD5
2e0d7252bae4a9e3039332fa15ea241c
-
SHA1
e6fd1144254105f7519f8e44871d36f527fc59e8
-
SHA256
a30c096e04c83b895b6172c51c8c91e5095220b83de5fe77c55be6f0e77379a0
-
SHA512
000f2cacc475c6411705ca35e7638259d6724633a091e6fcb7b7a21b44779fa71f34f12cfe0e6916a30d3cda279bcd44ab71ca1fbf0d04155dba30657be8d154
-
SSDEEP
768:XCBEtfJ+/PmzmeQ6jPMMLfOqB5EzeLneZReggk1GtBqJXiWUrzkEtHm:XCB+x+/PmblXWqBqqncRVgk1Gi6ztG
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog zermpsl.elf File opened for modification /dev/misc/watchdog zermpsl.elf -
Renames itself 1 IoCs
pid Process 742 zermpsl.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 202.61.197.122 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself cpuhp/0 742 zermpsl.elf -
description ioc Process File opened for reading /proc/33/comm zermpsl.elf File opened for reading /proc/138/comm zermpsl.elf File opened for reading /proc/713/comm zermpsl.elf File opened for reading /proc/3/comm zermpsl.elf File opened for reading /proc/12/comm zermpsl.elf File opened for reading /proc/117/comm zermpsl.elf File opened for reading /proc/685/comm zermpsl.elf File opened for reading /proc/695/comm zermpsl.elf File opened for reading /proc/8/comm zermpsl.elf File opened for reading /proc/48/comm zermpsl.elf File opened for reading /proc/202/comm zermpsl.elf File opened for reading /proc/4/comm zermpsl.elf File opened for reading /proc/6/comm zermpsl.elf File opened for reading /proc/23/comm zermpsl.elf File opened for reading /proc/45/comm zermpsl.elf File opened for reading /proc/112/comm zermpsl.elf File opened for reading /proc/118/comm zermpsl.elf File opened for reading /proc/388/comm zermpsl.elf File opened for reading /proc/392/comm zermpsl.elf File opened for reading /proc/17/comm zermpsl.elf File opened for reading /proc/25/comm zermpsl.elf File opened for reading /proc/366/comm zermpsl.elf File opened for reading /proc/415/comm zermpsl.elf File opened for reading /proc/705/comm zermpsl.elf File opened for reading /proc/710/comm zermpsl.elf File opened for reading /proc/137/comm zermpsl.elf File opened for reading /proc/20/comm zermpsl.elf File opened for reading /proc/31/comm zermpsl.elf File opened for reading /proc/47/comm zermpsl.elf File opened for reading /proc/59/comm zermpsl.elf File opened for reading /proc/711/comm zermpsl.elf File opened for reading /proc/717/comm zermpsl.elf File opened for reading /proc/258/comm zermpsl.elf File opened for reading /proc/7/comm zermpsl.elf File opened for reading /proc/9/comm zermpsl.elf File opened for reading /proc/14/comm zermpsl.elf File opened for reading /proc/377/comm zermpsl.elf File opened for reading /proc/15/comm zermpsl.elf File opened for reading /proc/16/comm zermpsl.elf File opened for reading /proc/24/comm zermpsl.elf File opened for reading /proc/181/comm zermpsl.elf File opened for reading /proc/22/comm zermpsl.elf File opened for reading /proc/37/comm zermpsl.elf File opened for reading /proc/114/comm zermpsl.elf File opened for reading /proc/732/comm zermpsl.elf File opened for reading /proc/355/comm zermpsl.elf File opened for reading /proc/383/comm zermpsl.elf File opened for reading /proc/731/comm zermpsl.elf File opened for reading /proc/26/comm zermpsl.elf File opened for reading /proc/30/comm zermpsl.elf File opened for reading /proc/32/comm zermpsl.elf File opened for reading /proc/391/comm zermpsl.elf File opened for reading /proc/363/comm zermpsl.elf File opened for reading /proc/1/comm zermpsl.elf File opened for reading /proc/13/comm zermpsl.elf File opened for reading /proc/34/comm zermpsl.elf File opened for reading /proc/35/comm zermpsl.elf File opened for reading /proc/53/comm zermpsl.elf File opened for reading /proc/58/comm zermpsl.elf File opened for reading /proc/720/comm zermpsl.elf File opened for reading /proc/10/comm zermpsl.elf File opened for reading /proc/19/comm zermpsl.elf File opened for reading /proc/27/comm zermpsl.elf File opened for reading /proc/28/comm zermpsl.elf