Analysis
-
max time kernel
123s -
max time network
155s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240729-en -
resource tags
arch:mipselimage:debian12-mipsel-20240729-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
10/03/2025, 02:04
Behavioral task
behavioral1
Sample
nklmpsl.elf
Resource
debian12-mipsel-20240729-en
debian-12-mipsel
8 signatures
150 seconds
General
-
Target
nklmpsl.elf
-
Size
67KB
-
MD5
8b0befb4dc3bcd729a1532e8a1833e09
-
SHA1
908733bf3cc880b09386a578d9c3d62dbd0163fa
-
SHA256
fd2866cead5f5a639a97523a21dc8794a9b750dc190e671d412aeefe0a549c3f
-
SHA512
0da0f3fd3c691f0d7b19977962961f4e6cdcc42bde47ac8fdc087e91c9fc0eb660c0b764b7a9a8b293cc1296065ef3a39cb1f83af4f72b3f407837cf4d019b1d
-
SSDEEP
768:/5FfwfG+uy2OM1mLsaJjvTXk02XFo08OoB5EzeLneZReggk1Lt2KXiWUrzkW:/5FIe+uyBMQE97oBqqncRVgk1LE7z
Score
9/10
Malware Config
Signatures
-
Contacts a large (145238) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nklmpsl.elf File opened for modification /dev/misc/watchdog nklmpsl.elf -
Renames itself 1 IoCs
pid Process 742 nklmpsl.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 51.158.108.203 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself sshd 742 nklmpsl.elf -
description ioc Process File opened for reading /proc/30/comm nklmpsl.elf File opened for reading /proc/37/comm nklmpsl.elf File opened for reading /proc/45/comm nklmpsl.elf File opened for reading /proc/202/comm nklmpsl.elf File opened for reading /proc/356/comm nklmpsl.elf File opened for reading /proc/118/comm nklmpsl.elf File opened for reading /proc/427/comm nklmpsl.elf File opened for reading /proc/721/comm nklmpsl.elf File opened for reading /proc/732/comm nklmpsl.elf File opened for reading /proc/1/comm nklmpsl.elf File opened for reading /proc/6/comm nklmpsl.elf File opened for reading /proc/110/comm nklmpsl.elf File opened for reading /proc/180/comm nklmpsl.elf File opened for reading /proc/19/comm nklmpsl.elf File opened for reading /proc/21/comm nklmpsl.elf File opened for reading /proc/390/comm nklmpsl.elf File opened for reading /proc/25/comm nklmpsl.elf File opened for reading /proc/111/comm nklmpsl.elf File opened for reading /proc/696/comm nklmpsl.elf File opened for reading /proc/10/comm nklmpsl.elf File opened for reading /proc/17/comm nklmpsl.elf File opened for reading /proc/24/comm nklmpsl.elf File opened for reading /proc/672/comm nklmpsl.elf File opened for reading /proc/7/comm nklmpsl.elf File opened for reading /proc/29/comm nklmpsl.elf File opened for reading /proc/47/comm nklmpsl.elf File opened for reading /proc/711/comm nklmpsl.elf File opened for reading /proc/736/comm nklmpsl.elf File opened for reading /proc/5/comm nklmpsl.elf File opened for reading /proc/14/comm nklmpsl.elf File opened for reading /proc/15/comm nklmpsl.elf File opened for reading /proc/28/comm nklmpsl.elf File opened for reading /proc/33/comm nklmpsl.elf File opened for reading /proc/2/comm nklmpsl.elf File opened for reading /proc/4/comm nklmpsl.elf File opened for reading /proc/379/comm nklmpsl.elf File opened for reading /proc/425/comm nklmpsl.elf File opened for reading /proc/706/comm nklmpsl.elf File opened for reading /proc/9/comm nklmpsl.elf File opened for reading /proc/13/comm nklmpsl.elf File opened for reading /proc/20/comm nklmpsl.elf File opened for reading /proc/34/comm nklmpsl.elf File opened for reading /proc/733/comm nklmpsl.elf File opened for reading /proc/18/comm nklmpsl.elf File opened for reading /proc/48/comm nklmpsl.elf File opened for reading /proc/53/comm nklmpsl.elf File opened for reading /proc/112/comm nklmpsl.elf File opened for reading /proc/350/comm nklmpsl.elf File opened for reading /proc/671/comm nklmpsl.elf File opened for reading /proc/744/comm nklmpsl.elf File opened for reading /proc/35/comm nklmpsl.elf File opened for reading /proc/58/comm nklmpsl.elf File opened for reading /proc/59/comm nklmpsl.elf File opened for reading /proc/712/comm nklmpsl.elf File opened for reading /proc/137/comm nklmpsl.elf File opened for reading /proc/138/comm nklmpsl.elf File opened for reading /proc/3/comm nklmpsl.elf File opened for reading /proc/12/comm nklmpsl.elf File opened for reading /proc/16/comm nklmpsl.elf File opened for reading /proc/22/comm nklmpsl.elf File opened for reading /proc/23/comm nklmpsl.elf File opened for reading /proc/32/comm nklmpsl.elf File opened for reading /proc/8/comm nklmpsl.elf File opened for reading /proc/27/comm nklmpsl.elf