Analysis
- max time kernel
109s - max time network
156s - platform
debian-12_mipsel - resource
debian12-mipsel-20260126-en - resource tags
arch:mipselimage:debian12-mipsel-20260126-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
20/04/2026, 00:29
Behavioral task
behavioral1
Sample
00okmpsl.elf
Resource
debian12-mipsel-20260126-en
debian-12-mipsel
5 signatures
150 seconds
General
- Target 00okmpsl.elf
- Size 57KB
- Sample260420-as792aev7p
- SHA256 bcd8805da45aaa227c3979c999890c3d5778d078d0a22f0d552b47a364387638
- MD5 2167fb8b9188de58a9302c4195c56f27
- SHA1 d21782a4960c3fef8a60bbeee83e70ae54d8d1f3
- SHA512 e311ad684c6be7eb4e7ef8c711260d05e98b4807f9a1dc17ff60634f28c6a3cd70318ddcb6cf93a00c769379b00164869d62e4e727a9971fcead9be29b0a4e57
- SSDEEP 768:oLWu89xw1IlGGUantlZIxY966x1EnB6NTcWlp21wmNOUGpCIMtjej5dIne2el9e2:oLWu8fwgUHkkLg9gzStS1
- TLSH T1C943710ABF650EB7EC6FDD3709A9174524CD651B21A87B3A7D34D81CF20B25B19E38A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog 00okmpsl.elf File opened for modification /dev/watchdog 00okmpsl.elf - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 00okmpsl.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself hsbbbbsbhsahbhaahh 800 00okmpsl.elf - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 00okmpsl.elf -
description ioc Process File opened for reading /proc/403/exe 00okmpsl.elf File opened for reading /proc/403/fd 00okmpsl.elf File opened for reading /proc/663/fd 00okmpsl.elf File opened for reading /proc/761/fd 00okmpsl.elf File opened for reading /proc/677/exe 00okmpsl.elf File opened for reading /proc/678/exe 00okmpsl.elf File opened for reading /proc/810/exe 00okmpsl.elf File opened for reading /proc/405/fd 00okmpsl.elf File opened for reading /proc/773/exe 00okmpsl.elf File opened for reading /proc/791/exe 00okmpsl.elf File opened for reading /proc/806/exe 00okmpsl.elf File opened for reading /proc/805/fd 00okmpsl.elf File opened for reading /proc/677/fd 00okmpsl.elf File opened for reading /proc/405/exe 00okmpsl.elf File opened for reading /proc/792/exe 00okmpsl.elf File opened for reading /proc/805/exe 00okmpsl.elf File opened for reading /proc/179/fd 00okmpsl.elf File opened for reading /proc/417/fd 00okmpsl.elf File opened for reading /proc/678/fd 00okmpsl.elf File opened for reading /proc/705/fd 00okmpsl.elf File opened for reading /proc/801/fd 00okmpsl.elf File opened for reading /proc/761/exe 00okmpsl.elf File opened for reading /proc/705/exe 00okmpsl.elf File opened for reading /proc/803/fd 00okmpsl.elf File opened for reading /proc/801/exe 00okmpsl.elf File opened for reading /proc/1/fd 00okmpsl.elf File opened for reading /proc/346/fd 00okmpsl.elf File opened for reading /proc/355/fd 00okmpsl.elf File opened for reading /proc/379/fd 00okmpsl.elf File opened for reading /proc/708/fd 00okmpsl.elf File opened for reading /proc/417/exe 00okmpsl.elf File opened for reading /proc/663/exe 00okmpsl.elf File opened for reading /proc/202/fd 00okmpsl.elf File opened for reading /proc/380/fd 00okmpsl.elf File opened for reading /proc/388/fd 00okmpsl.elf File opened for reading /proc/393/fd 00okmpsl.elf File opened for reading /proc/708/exe 00okmpsl.elf File opened for reading /proc/778/exe 00okmpsl.elf