Extracted

• • Target
    mpsl
  • Size 90KB
  • SHA256 d99b31750f60977568a66d9f948baa938f4650e33542384ade88f30c7ed61821
  • MD5 818732bbe5f099130ce12c80a7b855e2
  • SHA1 4f73e83b7be6db70cfe73a3b590838b749331fc8
  • SHA512 50290f49d30babc189d7843e353549f728974376d282d03f43ca8674c65b08b868472be28be9d69f4527c23eccfadf38d0de1897883ff92efd6129fbb35bf121
  • SSDEEP 1536:a5DnSB+v5RjQm2T17xk49d6xZLu8vJ4TGo8S:a5TSB+v5RjQm61GFrvhrS
  • TLSH
    T10A93A309BFA05EF7E8AFCC3345D92745288D655A21A83F79B930D928B21B24F15E3C74
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdefense_evasiondiscovery

  • Contacts a large (85252) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Reads process memory

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  behavioral1