Analysis
- max time kernel
151s - max time network
155s - platform
debian-12_mipsel - resource
debian12-mipsel-20260126-en - resource tags
arch:mipselimage:debian12-mipsel-20260126-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
22/04/2026, 16:59
Behavioral task
behavioral1
Sample
pmpsl.elf
Resource
debian12-mipsel-20260126-en
debian-12-mipsel
6 signatures
150 seconds
General
- Target pmpsl.elf
- Size 95KB
- Sample260422-vhpp6act3j
- SHA256 f11e1db44693d03adf5a4a7a58c2f602cac0d764e184ae1a2bf18e5899398ef4
- MD5 92b67e0febefd21d4c9bb1d6daf4671f
- SHA1 dcc753c7df6cf08bdea52caeff6582db0482c031
- SHA512 4826df678aa9a5db23cb7ebe32b4bf5ba4337c0b32e4bf2531860825dcdf9ec5f21a4ff0144ea375ad7daf880fd2296df08166f278008ad3e4c38c545e4cbd42
- SSDEEP 1536:LvGefaZSdtJP4/xl4ExO29zyN0ZNhdZp54crFCZeLs/h5J:LOefaZSdI59zm0Hr6eoJ
- TLSH T1C4A3F506BB650FF7DC6FCD3706A9070225CCA51B22B83B767674C928B50B65B4AE3874
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 801 pmpsl.elf - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog pmpsl.elf File opened for modification /dev/misc/watchdog pmpsl.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself 834g8n1we4mdle5efjm8vkin 801 pmpsl.elf -
description ioc Process File opened for reading /proc/37/cmdline pmpsl.elf File opened for reading /proc/764/cmdline pmpsl.elf File opened for reading /proc/803/cmdline pmpsl.elf File opened for reading /proc/823cmdline pmpsl.elf File opened for reading /proc/855/cmdline pmpsl.elf File opened for reading /proc/9cmdline pmpsl.elf File opened for reading /proc/21cmdline pmpsl.elf File opened for reading /proc/394cmdline pmpsl.elf File opened for reading /proc/109/cmdline pmpsl.elf File opened for reading /proc/203/cmdline pmpsl.elf File opened for reading /proc/28cmdline pmpsl.elf File opened for reading /proc/870/cmdline pmpsl.elf File opened for reading /proc/1cmdline pmpsl.elf File opened for reading /proc/30cmdline pmpsl.elf File opened for reading /proc/379cmdline pmpsl.elf File opened for reading /proc/390cmdline pmpsl.elf File opened for reading /proc/6/cmdline pmpsl.elf File opened for reading /proc/119/cmdline pmpsl.elf File opened for reading /proc/861/cmdline pmpsl.elf File opened for reading /proc/111cmdline pmpsl.elf File opened for reading /proc/663cmdline pmpsl.elf File opened for reading /proc/44/cmdline pmpsl.elf File opened for reading /proc/441/cmdline pmpsl.elf File opened for reading /proc/761/cmdline pmpsl.elf File opened for reading /proc/856/cmdline pmpsl.elf File opened for reading /proc/137cmdline pmpsl.elf File opened for reading /proc/11cmdline pmpsl.elf File opened for reading /proc/806cmdline pmpsl.elf File opened for reading /proc/11/cmdline pmpsl.elf File opened for reading /proc/20/cmdline pmpsl.elf File opened for reading /proc/394/cmdline pmpsl.elf File opened for reading /proc/810/cmdline pmpsl.elf File opened for reading /proc/5cmdline pmpsl.elf File opened for reading /proc/12cmdline pmpsl.elf File opened for reading /proc/17/cmdline pmpsl.elf File opened for reading /proc/34/cmdline pmpsl.elf File opened for reading /proc/59/cmdline pmpsl.elf File opened for reading /proc/137/cmdline pmpsl.elf File opened for reading /proc/854cmdline pmpsl.elf File opened for reading /proc/31cmdline pmpsl.elf File opened for reading /proc/34cmdline pmpsl.elf File opened for reading /proc/401cmdline pmpsl.elf File opened for reading /proc/694cmdline pmpsl.elf File opened for reading /proc/15/cmdline pmpsl.elf File opened for reading /proc/677/cmdline pmpsl.elf File opened for reading /proc/678/cmdline pmpsl.elf File opened for reading /proc/791/cmdline pmpsl.elf File opened for reading /proc/8cmdline pmpsl.elf File opened for reading /proc/10cmdline pmpsl.elf File opened for reading /proc/44cmdline pmpsl.elf File opened for reading /proc/29/cmdline pmpsl.elf File opened for reading /proc/108/cmdline pmpsl.elf File opened for reading /proc/819/cmdline pmpsl.elf File opened for reading /proc/59cmdline pmpsl.elf File opened for reading /proc/764cmdline pmpsl.elf File opened for reading /proc/4/cmdline pmpsl.elf File opened for reading /proc/7/cmdline pmpsl.elf File opened for reading /proc/111/cmdline pmpsl.elf File opened for reading /proc/379/cmdline pmpsl.elf File opened for reading /proc/22cmdline pmpsl.elf File opened for reading /proc/772cmdline pmpsl.elf File opened for reading /proc/794cmdline pmpsl.elf File opened for reading /proc/14/cmdline pmpsl.elf File opened for reading /proc/47/cmdline pmpsl.elf - Writes file to shm directory 1 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
description ioc Process File opened for modification /dev/shm/.comm pmpsl.elf
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /dev/shm/.comm
- Size 4B
- SHA256 452e39c241ac7c3d1fe29b5529a5e2ea849dff1f35727ab388946535f4f2f0f8
- MD5 5bf1df05725098b6d3fc9aabc97e5948
- SHA1 7f2a920fe82eed9bd99efd5fa442416ebdc5b145
- SHA512 1b3366083db7cf230465eb9aafc1b6e8f7caa0b39668420a293f06fbe151cb2585d009dd343f0ba01477c75a137ed12103623262846c8f020d6c371318874816
- MD5 SHA1 SHA512