Analysis
- max time kernel
122s - max time network
142s - platform
debian-12_mipsel - resource
debian12-mipsel-20260127-en - resource tags
arch:mipselimage:debian12-mipsel-20260127-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
27/01/2026, 12:37
Static task
static1
Behavioral task
behavioral1
Sample
zermpsl.elf
Resource
debian12-mipsel-20260127-en
debian-12-mipsel
5 signatures
150 seconds
General
- Target zermpsl.elf
- Size 110KB
- Sample260127-ptpxeaex7e
- SHA256 d964a7a68c53a69a082064984e6779bf20d0b00f3e5eb6c729cf745650f7f595
- MD5 9ab15978f25c8a7d273b52dd7511ce16
- SHA1 a4edb89282161ef092a560a34764ce775e60682c
- SHA512 fc83b99fe399e139199e86401e09b63171c4dd2835bf0b7ed714f2d20f1b58810decd4f938129990c54f0136c338c91f631a1df91366eb6a278ca80732e1543d
- SSDEEP 1536:yonVE04Ocu4gaP5/muoT5WML3Wj0M9q9YCtLbVM81yxuJG/HeLIeZfqFX39wu7r2:yOF35WrcI42Kq9Y3w1h20YKq5X
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 770 zermpsl.elf - Executes dropped EXE 1 IoCs
ioc pid Process /dev/shm/.auditd 770 zermpsl.elf - Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/389/cmdline .auditd File opened for reading /proc/19/cmdline zermpsl.elf File opened for reading /proc/23/cmdline zermpsl.elf File opened for reading /proc/338/cmdline .auditd File opened for reading /proc/408/cmdline .auditd File opened for reading /proc/5/cmdline zermpsl.elf File opened for reading /proc/112/cmdline zermpsl.elf File opened for reading /proc/25/cmdline .auditd File opened for reading /proc/17/cmdline zermpsl.elf File opened for reading /proc/34/cmdline zermpsl.elf File opened for reading /proc/42/cmdline zermpsl.elf File opened for reading /proc/58/cmdline .auditd File opened for reading /proc/180/cmdline zermpsl.elf File opened for reading /proc/10/cmdline .auditd File opened for reading /proc/201/cmdline .auditd File opened for reading /proc/407/cmdline .auditd File opened for reading /proc/37/cmdline zermpsl.elf File opened for reading /proc/24/cmdline .auditd File opened for reading /proc/28/cmdline .auditd File opened for reading /proc/13/cmdline zermpsl.elf File opened for reading /proc/15/cmdline zermpsl.elf File opened for reading /proc/4/cmdline .auditd File opened for reading /proc/118/cmdline .auditd File opened for reading /proc/10/cmdline zermpsl.elf File opened for reading /proc/12/cmdline zermpsl.elf File opened for reading /proc/407/cmdline zermpsl.elf File opened for reading /proc/31/cmdline .auditd File opened for reading /proc/378/cmdline zermpsl.elf File opened for reading /proc/11/cmdline zermpsl.elf File opened for reading /proc/113/cmdline zermpsl.elf File opened for reading /proc/137/cmdline zermpsl.elf File opened for reading /proc/201/cmdline zermpsl.elf File opened for reading /proc/16/cmdline .auditd File opened for reading /proc/23/cmdline .auditd File opened for reading /proc/378/cmdline .auditd File opened for reading /proc/16/cmdline zermpsl.elf File opened for reading /proc/29/cmdline zermpsl.elf File opened for reading /proc/33/cmdline zermpsl.elf File opened for reading /proc/118/cmdline zermpsl.elf File opened for reading /proc/342/cmdline zermpsl.elf File opened for reading /proc/12/cmdline .auditd File opened for reading /proc/27/cmdline .auditd File opened for reading /proc/180/cmdline .auditd File opened for reading /proc/22/cmdline zermpsl.elf File opened for reading /proc/47/cmdline zermpsl.elf File opened for reading /proc/5/cmdline .auditd File opened for reading /proc/42/cmdline .auditd File opened for reading /proc/30/cmdline zermpsl.elf File opened for reading /proc/338/cmdline zermpsl.elf File opened for reading /proc/48/cmdline .auditd File opened for reading /proc/114/cmdline .auditd File opened for reading /proc/7/cmdline zermpsl.elf File opened for reading /proc/20/cmdline zermpsl.elf File opened for reading /proc/48/cmdline zermpsl.elf File opened for reading /proc/408/cmdline zermpsl.elf File opened for reading /proc/432/cmdline zermpsl.elf File opened for reading /proc/662/cmdline zermpsl.elf File opened for reading /proc/14/cmdline .auditd File opened for reading /proc/53/cmdline .auditd File opened for reading /proc/137/cmdline .auditd File opened for reading /proc/9/cmdline zermpsl.elf File opened for reading /proc/376/cmdline zermpsl.elf File opened for reading /proc/2/cmdline .auditd File opened for reading /proc/17/cmdline .auditd - Writes file to shm directory 2 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
description ioc Process File opened for modification /dev/shm/.auditd zermpsl.elf File opened for modification /dev/shm/.test_exec_770 zermpsl.elf
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /dev/shm/.auditd
- Size 110KB
- SHA256 d964a7a68c53a69a082064984e6779bf20d0b00f3e5eb6c729cf745650f7f595
- MD5 9ab15978f25c8a7d273b52dd7511ce16
- SHA1 a4edb89282161ef092a560a34764ce775e60682c
- SHA512 fc83b99fe399e139199e86401e09b63171c4dd2835bf0b7ed714f2d20f1b58810decd4f938129990c54f0136c338c91f631a1df91366eb6a278ca80732e1543d
- SSDEEP 1536:yonVE04Ocu4gaP5/muoT5WML3Wj0M9q9YCtLbVM81yxuJG/HeLIeZfqFX39wu7r2:yOF35WrcI42Kq9Y3w1h20YKq5X
- TLSH T1ADB3090AAF711EBBD4AFDD3345A5074A399D550721B83B3A3674D81CF61A68F0AE3C60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /dev/shm/.test_exec_770
- Size 4B
- SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
- MD5 098f6bcd4621d373cade4e832627b4f6
- SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
- SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
- MD5 SHA1 SHA512