Analysis
- max time kernel
83s - max time network
142s - platform
debian-12_mipsel - resource
debian12-mipsel-20250619-en - resource tags
arch:mipselimage:debian12-mipsel-20250619-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
27/10/2025, 22:31
Behavioral task
behavioral1
Sample
Orbt.mpsl.elf
Resource
debian12-mipsel-20250619-en
debian-12-mipsel
6 signatures
150 seconds
General
- Target Orbt.mpsl.elf
- Size 70KB
- Sample251027-2fdnfaav6e
- SHA256 15e6b9a5a69d2e610d64e18548a4096fd84506a0341d20a321b1bb07f0e86127
- MD5 a37fd68208babb4ebfcbbf35b97782d9
- SHA1 4aa169761da39ec25e10d000095154451a932a82
- SHA512 b9a790bd38b92b7255533e973aa8de4466152826dba94d57ce17a8d6e8a7fd906b1048e3b74e4a309a43db0c0f6aa957fb59ca1347c25a057a5f0a91927698ae
- SSDEEP 1536:1pugbRQ6HGS6ro7l7ReGw9hyErmyHQnSd77sxBRckV:BOj+BkGaNHEAmBRT
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Mirai family
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Orbt.mpsl.elf File opened for modification /dev/misc/watchdog Orbt.mpsl.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Orbt.mpsl.elf File opened for modification /bin/watchdog Orbt.mpsl.elf -
description ioc Process File opened for reading /proc/3/status Orbt.mpsl.elf File opened for reading /proc/9/status Orbt.mpsl.elf File opened for reading /proc/16/status Orbt.mpsl.elf File opened for reading /proc/29/status Orbt.mpsl.elf File opened for reading /proc/402/status Orbt.mpsl.elf File opened for reading /proc/677/status Orbt.mpsl.elf File opened for reading /proc/775/status Orbt.mpsl.elf File opened for reading /proc/2/status Orbt.mpsl.elf File opened for reading /proc/12/status Orbt.mpsl.elf File opened for reading /proc/58/status Orbt.mpsl.elf File opened for reading /proc/763/status Orbt.mpsl.elf File opened for reading /proc/801/status Orbt.mpsl.elf File opened for reading /proc/13/status Orbt.mpsl.elf File opened for reading /proc/48/status Orbt.mpsl.elf File opened for reading /proc/377/status Orbt.mpsl.elf File opened for reading /proc/800/status Orbt.mpsl.elf File opened for reading /proc/26/status Orbt.mpsl.elf File opened for reading /proc/45/status Orbt.mpsl.elf File opened for reading /proc/765/status Orbt.mpsl.elf File opened for reading /proc/22/status Orbt.mpsl.elf File opened for reading /proc/404/status Orbt.mpsl.elf File opened for reading /proc/678/status Orbt.mpsl.elf File opened for reading /proc/761/status Orbt.mpsl.elf File opened for reading /proc/787/status Orbt.mpsl.elf File opened for reading /proc/804/status Orbt.mpsl.elf File opened for reading /proc/805/status Orbt.mpsl.elf File opened for reading /proc/10/status Orbt.mpsl.elf File opened for reading /proc/14/status Orbt.mpsl.elf File opened for reading /proc/21/status Orbt.mpsl.elf File opened for reading /proc/388/status Orbt.mpsl.elf File opened for reading /proc/32/status Orbt.mpsl.elf File opened for reading /proc/112/status Orbt.mpsl.elf File opened for reading /proc/294/status Orbt.mpsl.elf File opened for reading /proc/380/status Orbt.mpsl.elf File opened for reading /proc/806/status Orbt.mpsl.elf File opened for reading /proc/5/status Orbt.mpsl.elf File opened for reading /proc/42/status Orbt.mpsl.elf File opened for reading /proc/59/status Orbt.mpsl.elf File opened for reading /proc/330/status Orbt.mpsl.elf File opened for reading /proc/769/status Orbt.mpsl.elf File opened for reading /proc/789/status Orbt.mpsl.elf File opened for reading /proc/4/status Orbt.mpsl.elf File opened for reading /proc/23/status Orbt.mpsl.elf File opened for reading /proc/33/status Orbt.mpsl.elf File opened for reading /proc/34/status Orbt.mpsl.elf File opened for reading /proc/47/status Orbt.mpsl.elf File opened for reading /proc/1/status Orbt.mpsl.elf File opened for reading /proc/7/status Orbt.mpsl.elf File opened for reading /proc/8/status Orbt.mpsl.elf File opened for reading /proc/20/status Orbt.mpsl.elf File opened for reading /proc/28/status Orbt.mpsl.elf File opened for reading /proc/35/status Orbt.mpsl.elf File opened for reading /proc/710/status Orbt.mpsl.elf File opened for reading /proc/19/status Orbt.mpsl.elf File opened for reading /proc/24/status Orbt.mpsl.elf File opened for reading /proc/115/status Orbt.mpsl.elf File opened for reading /proc/705/status Orbt.mpsl.elf File opened for reading /proc/788/status Orbt.mpsl.elf File opened for reading /proc/791/status Orbt.mpsl.elf File opened for reading /proc/6/status Orbt.mpsl.elf File opened for reading /proc/11/status Orbt.mpsl.elf File opened for reading /proc/17/status Orbt.mpsl.elf File opened for reading /proc/25/status Orbt.mpsl.elf File opened for reading /proc/30/status Orbt.mpsl.elf