Analysis
- max time kernel
150s - max time network
155s - platform
debian-12_mipsel - resource
debian12-mipsel-20251231-en - resource tags
arch:mipselimage:debian12-mipsel-20251231-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
02/01/2026, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
splmpsl.elf
Resource
debian12-mipsel-20251231-en
9 signatures
150 seconds
General
- Target splmpsl.elf
- Size 84KB
- Sample260102-b2ppqae18b
- SHA256 0e23ae99edd0c08d90d41174eacdb6af908d9a74b92bbc42a3ad8e11b91afb8d
- MD5 b851c580129e9e0e3bb4890ebabc1050
- SHA1 e5e5d831d59d8773e0b4ca2f5968fc4e20fcc5e1
- SHA512 f862de50eede26357f7cc52080ad0529cf048d96d971694b81e903fefd65c72d9ca7a42acc9c177b70fe96355d88b60dccf774bbf1715e5ea4ffab4c21dbc690
- SSDEEP 1536:GrPrNxCA6efAYHQSgvYDq5Zmko5PXI2bDc6yRNGhmAfQlu+7RX:GrjNxwefbHVaYSZmkohI2Zolu+
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Contacts a large (25908) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Renames itself 1 IoCs
pid Process 798 splmpsl.elf - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp splmpsl.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 9 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/838/maps splmpsl.elf File opened for reading /proc/820/maps splmpsl.elf File opened for reading /proc/821/maps splmpsl.elf File opened for reading /proc/824/maps splmpsl.elf File opened for reading /proc/825/maps splmpsl.elf File opened for reading /proc/835/maps splmpsl.elf File opened for reading /proc/822/maps splmpsl.elf File opened for reading /proc/826/maps splmpsl.elf File opened for reading /proc/832/maps splmpsl.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself 800 splmpsl.elf - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp splmpsl.elf -
description ioc Process File opened for reading /proc/763/status splmpsl.elf File opened for reading /proc/766/status splmpsl.elf File opened for reading /proc/self/maps splmpsl.elf File opened for reading /proc/821/cmdline splmpsl.elf File opened for reading /proc/832/cmdline splmpsl.elf File opened for reading /proc/838/cmdline splmpsl.elf File opened for reading /proc/201/status splmpsl.elf File opened for reading /proc/395/status splmpsl.elf File opened for reading /proc/662/status splmpsl.elf File opened for reading /proc/679/status splmpsl.elf File opened for reading /proc/180/status splmpsl.elf File opened for reading /proc/378/status splmpsl.elf File opened for reading /proc/417/status splmpsl.elf File opened for reading /proc/704/status splmpsl.elf File opened for reading /proc/795/status splmpsl.elf File opened for reading /proc/820/cmdline splmpsl.elf File opened for reading /proc/336/status splmpsl.elf File opened for reading /proc/396/status splmpsl.elf File opened for reading /proc/699/status splmpsl.elf File opened for reading /proc/764/status splmpsl.elf File opened for reading /proc/824/cmdline splmpsl.elf File opened for reading /proc/825/cmdline splmpsl.elf File opened for reading /proc/826/cmdline splmpsl.elf File opened for reading /proc/680/status splmpsl.elf File opened for reading /proc/794/status splmpsl.elf File opened for reading /proc/822/cmdline splmpsl.elf File opened for reading /proc/379/status splmpsl.elf File opened for reading /proc/385/status splmpsl.elf File opened for reading /proc/352/status splmpsl.elf File opened for reading /proc/389/status splmpsl.elf File opened for reading /proc/835/cmdline splmpsl.elf File opened for reading /proc/376/status splmpsl.elf