2d115365628417f4ddcd8d23170d1b24ce6882af1e8ac53afb73ae697cfe7c99

Analysis

max time kernel
123s
max time network
155s
platform
debian-12_mipsel
resource
debian12-mipsel-20251231-en
resource tags

arch:mipselimage:debian12-mipsel-20251231-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
11/01/2026, 00:58

Target
nklmpsl.elf
Size 95KB
Sample260111-bbmsfabz5a
SHA256 2d115365628417f4ddcd8d23170d1b24ce6882af1e8ac53afb73ae697cfe7c99
MD5 a512e4a5250554b3041e4960907d4fa9
SHA1 1aeafe0722c32e2a85e9031b77a38cc0e4e509bf
SHA512 6934b4c5bc326a5780d2675d502802d832123375a85ebdeca458f1cf65862df27802fd3b809f20e5afdfc9165cdecb15c05c637d9f3636d09811eba39b1f8663
SSDEEP 1536:Dh7wKbHulgTyFCH5Y2Mt1uT/bqJp8mkfjVV5fT12FuQfTAbVR3q:DNdHuCEQYDt1uEyBOu0TAS
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery

Contacts a large (12711) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Renames itself 1 IoCs

pid	Process
800	nklmpsl.elf

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself		802	nklmpsl.elf

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact