Analysis
- max time kernel
150s - max time network
148s - platform
debian-12_mipsel - resource
debian12-mipsel-20251231-en - resource tags
arch:mipselimage:debian12-mipsel-20251231-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
11/01/2026, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
nabmpsl.elf
Resource
debian12-mipsel-20251231-en
debian-12-mipsel
9 signatures
150 seconds
General
- Target nabmpsl.elf
- Size 78KB
- Sample260111-bwgf6acy4e
- SHA256 6a6d0e8132fc2555201d7b7572d2b34ad5770ddee51ecdb897516f3b498047b9
- MD5 1f7f4435d7ef088116ab50578ab1d070
- SHA1 752a63a0d1fe34e155bc287e44ff6ebf884ea2d2
- SHA512 69c05365e70162faed292e63e7fc84679dc77bf87bdfee82f32f8337e00dd4ccd7a8fbba320af08a6933f419a0937ea9954db3837b051a753145a1b4f8c1d0cf
- SSDEEP 1536:Hb03sU5Z/oKqsSq+7Lj/FV/H6UHdgPDcPv+dfigOwT2bVR:HA3TZ8/H6UJUfigFT2
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Contacts a large (11367) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Renames itself 1 IoCs
pid Process 800 nabmpsl.elf - Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp nabmpsl.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 8 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/825/maps nabmpsl.elf File opened for reading /proc/826/maps nabmpsl.elf File opened for reading /proc/834/maps nabmpsl.elf File opened for reading /proc/837/maps nabmpsl.elf File opened for reading /proc/817/maps nabmpsl.elf File opened for reading /proc/822/maps nabmpsl.elf File opened for reading /proc/823/maps nabmpsl.elf File opened for reading /proc/824/maps nabmpsl.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself 802 nabmpsl.elf - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp nabmpsl.elf -
description ioc Process File opened for reading /proc/765/status nabmpsl.elf File opened for reading /proc/794/status nabmpsl.elf File opened for reading /proc/822/cmdline nabmpsl.elf File opened for reading /proc/834/cmdline nabmpsl.elf File opened for reading /proc/402/status nabmpsl.elf File opened for reading /proc/823/cmdline nabmpsl.elf File opened for reading /proc/837/cmdline nabmpsl.elf File opened for reading /proc/817/cmdline nabmpsl.elf File opened for reading /proc/259/status nabmpsl.elf File opened for reading /proc/391/status nabmpsl.elf File opened for reading /proc/663/status nabmpsl.elf File opened for reading /proc/677/status nabmpsl.elf File opened for reading /proc/700/status nabmpsl.elf File opened for reading /proc/762/status nabmpsl.elf File opened for reading /proc/366/status nabmpsl.elf File opened for reading /proc/370/status nabmpsl.elf File opened for reading /proc/373/status nabmpsl.elf File opened for reading /proc/378/status nabmpsl.elf File opened for reading /proc/385/status nabmpsl.elf File opened for reading /proc/697/status nabmpsl.elf File opened for reading /proc/self/maps nabmpsl.elf File opened for reading /proc/179/status nabmpsl.elf File opened for reading /proc/202/status nabmpsl.elf File opened for reading /proc/383/status nabmpsl.elf File opened for reading /proc/761/status nabmpsl.elf File opened for reading /proc/793/status nabmpsl.elf File opened for reading /proc/825/cmdline nabmpsl.elf File opened for reading /proc/826/cmdline nabmpsl.elf File opened for reading /proc/824/cmdline nabmpsl.elf File opened for reading /proc/390/status nabmpsl.elf File opened for reading /proc/678/status nabmpsl.elf