Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240611-en -
resource tags
arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
23/03/2025, 21:27
Behavioral task
behavioral1
Sample
pmpsl.elf
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
6 signatures
150 seconds
General
-
Target
pmpsl.elf
-
Size
49KB
-
MD5
c6e97e7019d1deb2815994f5c7241c09
-
SHA1
a5e74b0b0884efbdae0c27433db1bf7e702a9ea1
-
SHA256
fd69c599111ca3d7dbe937c74df58b1933d69fea6f47636d485bf5321135b6fe
-
SHA512
564164156fac1b435afd0728eb10ba6e61a114773492f1f3202b613adf554904850f1269ceeb47fb59deb0e175c4de1281c79abb24e6f74b6b8afc98a7a284f8
-
SSDEEP
768:nbbIVTCpNpqW10FtrDS+tZb9ddQm8MSbhYhFkQkVmKTlFHcmW5DQYgmJaD9UkV:nbcCfpqY0FtKm8h4uVmAlFHagyaqS
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
MIRAI
Signatures
-
Mirai family
-
Deletes itself 1 IoCs
pid Process 700 pmpsl.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog pmpsl.elf File opened for modification /dev/misc/watchdog pmpsl.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself 6k3271g3456ghgt6mkrq 700 pmpsl.elf -
description ioc Process File opened for reading /proc/13cmdline pmpsl.elf File opened for reading /proc/72cmdline pmpsl.elf File opened for reading /proc/146cmdline pmpsl.elf File opened for reading /proc/722cmdline pmpsl.elf File opened for reading /proc/763cmdline pmpsl.elf File opened for reading /proc/764cmdline pmpsl.elf File opened for reading /proc/808cmdline pmpsl.elf File opened for reading /proc/3cmdline pmpsl.elf File opened for reading /proc/315cmdline pmpsl.elf File opened for reading /proc/712cmdline pmpsl.elf File opened for reading /proc/768cmdline pmpsl.elf File opened for reading /proc/116cmdline pmpsl.elf File opened for reading /proc/693cmdline pmpsl.elf File opened for reading /proc/727cmdline pmpsl.elf File opened for reading /proc/753cmdline pmpsl.elf File opened for reading /proc/6cmdline pmpsl.elf File opened for reading /proc/14cmdline pmpsl.elf File opened for reading /proc/679cmdline pmpsl.elf File opened for reading /proc/751cmdline pmpsl.elf File opened for reading /proc/762cmdline pmpsl.elf File opened for reading /proc/782cmdline pmpsl.elf File opened for reading /proc/74cmdline pmpsl.elf File opened for reading /proc/378cmdline pmpsl.elf File opened for reading /proc/672cmdline pmpsl.elf File opened for reading /proc/750cmdline pmpsl.elf File opened for reading /proc/774cmdline pmpsl.elf File opened for reading /proc/796cmdline pmpsl.elf File opened for reading /proc/24cmdline pmpsl.elf File opened for reading /proc/421cmdline pmpsl.elf File opened for reading /proc/717cmdline pmpsl.elf File opened for reading /proc/733cmdline pmpsl.elf File opened for reading /proc/776cmdline pmpsl.elf File opened for reading /proc/7cmdline pmpsl.elf File opened for reading /proc/16cmdline pmpsl.elf File opened for reading /proc/21cmdline pmpsl.elf File opened for reading /proc/708cmdline pmpsl.elf File opened for reading /proc/709cmdline pmpsl.elf File opened for reading /proc/726cmdline pmpsl.elf File opened for reading /proc/743cmdline pmpsl.elf File opened for reading /proc/781cmdline pmpsl.elf File opened for reading /proc/76cmdline pmpsl.elf File opened for reading /proc/367cmdline pmpsl.elf File opened for reading /proc/759cmdline pmpsl.elf File opened for reading /proc/341cmdline pmpsl.elf File opened for reading /proc/697cmdline pmpsl.elf File opened for reading /proc/721cmdline pmpsl.elf File opened for reading /proc/800cmdline pmpsl.elf File opened for reading /proc/807cmdline pmpsl.elf File opened for reading /proc/8cmdline pmpsl.elf File opened for reading /proc/725cmdline pmpsl.elf File opened for reading /proc/739cmdline pmpsl.elf File opened for reading /proc/752cmdline pmpsl.elf File opened for reading /proc/784cmdline pmpsl.elf File opened for reading /proc/369cmdline pmpsl.elf File opened for reading /proc/756cmdline pmpsl.elf File opened for reading /proc/804cmdline pmpsl.elf File opened for reading /proc/167cmdline pmpsl.elf File opened for reading /proc/737cmdline pmpsl.elf File opened for reading /proc/741cmdline pmpsl.elf File opened for reading /proc/755cmdline pmpsl.elf File opened for reading /proc/757cmdline pmpsl.elf File opened for reading /proc/773cmdline pmpsl.elf File opened for reading /proc/150cmdline pmpsl.elf File opened for reading /proc/707cmdline pmpsl.elf