Analysis
- max time kernel
147s - max time network
153s - platform
debian-12_mipsel - resource
debian12-mipsel-20260126-en - resource tags
arch:mipselimage:debian12-mipsel-20260126-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
27/04/2026, 00:58
Static task
static1
Behavioral task
behavioral1
Sample
xdf.mpsl
Resource
debian12-mipsel-20260126-en
debian-12-mipsel
6 signatures
150 seconds
General
- Target xdf.mpsl
- Size 134KB
- Sample260427-bbvs2saz7y
- SHA256 c308caa00f8eb0824b0def1ce58f5abf9072ff6e6db0d078718146e819f59563
- MD5 3430d28e594b4db854fd4282688bbcb1
- SHA1 65b8abc80c833414639f705c7332c62838f46463
- SHA512 9f8687befaeea06424df9d7427948e7bf2e8c4c7db242561f03f2df86eb89c57a78dee7f9bb2947494eb6cef72a384fcdba08805b61d72bb09e238fcf145e4e1
- SSDEEP 1536:upUpwpUBAZOcFrMkBQrmWVohoAlJy7KrvIA95fXUG4NZdp92V3d:upUpwpUiPS6nIq5vA8V3d
- TLSH T113D3312ABB619FBBDC1ECD7306A94601108CA95A12D92F7FF6B0D518E38BC4E44D3D64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 801 xdf.mpsl - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog xdf.mpsl File opened for modification /dev/misc/watchdog xdf.mpsl - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/137/maps xdf.mpsl File opened for reading /proc/42/maps xdf.mpsl File opened for reading /proc/111/maps xdf.mpsl File opened for reading /proc/118/maps xdf.mpsl File opened for reading /proc/370/maps xdf.mpsl File opened for reading /proc/10/maps xdf.mpsl File opened for reading /proc/18/maps xdf.mpsl File opened for reading /proc/21/maps xdf.mpsl File opened for reading /proc/31/maps xdf.mpsl File opened for reading /proc/391/maps xdf.mpsl File opened for reading /proc/792/maps xdf.mpsl File opened for reading /proc/4/maps xdf.mpsl File opened for reading /proc/7/maps xdf.mpsl File opened for reading /proc/14/maps xdf.mpsl File opened for reading /proc/28/maps xdf.mpsl File opened for reading /proc/29/maps xdf.mpsl File opened for reading /proc/109/maps xdf.mpsl File opened for reading /proc/856/maps xdf.mpsl File opened for reading /proc/11/maps xdf.mpsl File opened for reading /proc/13/maps xdf.mpsl File opened for reading /proc/17/maps xdf.mpsl File opened for reading /proc/19/maps xdf.mpsl File opened for reading /proc/23/maps xdf.mpsl File opened for reading /proc/25/maps xdf.mpsl File opened for reading /proc/388/maps xdf.mpsl File opened for reading /proc/114/maps xdf.mpsl File opened for reading /proc/181/maps xdf.mpsl File opened for reading /proc/366/maps xdf.mpsl File opened for reading /proc/12/maps xdf.mpsl File opened for reading /proc/22/maps xdf.mpsl File opened for reading /proc/32/maps xdf.mpsl File opened for reading /proc/44/maps xdf.mpsl File opened for reading /proc/58/maps xdf.mpsl File opened for reading /proc/119/maps xdf.mpsl File opened for reading /proc/3/maps xdf.mpsl File opened for reading /proc/15/maps xdf.mpsl File opened for reading /proc/112/maps xdf.mpsl File opened for reading /proc/700/maps xdf.mpsl File opened for reading /proc/762/maps xdf.mpsl File opened for reading /proc/24/maps xdf.mpsl File opened for reading /proc/384/maps xdf.mpsl File opened for reading /proc/764/maps xdf.mpsl File opened for reading /proc/817/maps xdf.mpsl File opened for reading /proc/409/maps xdf.mpsl File opened for reading /proc/778/maps xdf.mpsl File opened for reading /proc/807/maps xdf.mpsl File opened for reading /proc/261/maps xdf.mpsl File opened for reading /proc/677/maps xdf.mpsl File opened for reading /proc/678/maps xdf.mpsl File opened for reading /proc/791/maps xdf.mpsl File opened for reading /proc/138/maps xdf.mpsl File opened for reading /proc/203/maps xdf.mpsl File opened for reading /proc/369/maps xdf.mpsl File opened for reading /proc/26/maps xdf.mpsl File opened for reading /proc/2/maps xdf.mpsl File opened for reading /proc/8/maps xdf.mpsl File opened for reading /proc/20/maps xdf.mpsl File opened for reading /proc/48/maps xdf.mpsl File opened for reading /proc/5/maps xdf.mpsl File opened for reading /proc/27/maps xdf.mpsl File opened for reading /proc/761/maps xdf.mpsl File opened for reading /proc/794/maps xdf.mpsl File opened for reading /proc/819/maps xdf.mpsl File opened for reading /proc/6/maps xdf.mpsl - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself uucp 801 xdf.mpsl -
description ioc Process File opened for reading /proc/16/cmdline xdf.mpsl File opened for reading /proc/28/cmdline xdf.mpsl File opened for reading /proc/137/cmdline xdf.mpsl File opened for reading /proc/181/cmdline xdf.mpsl File opened for reading /proc/138/cmdline xdf.mpsl File opened for reading /proc/388/cmdline xdf.mpsl File opened for reading /proc/47/cmdline xdf.mpsl File opened for reading /proc/366/cmdline xdf.mpsl File opened for reading /proc/391/cmdline xdf.mpsl File opened for reading /proc/392/cmdline xdf.mpsl File opened for reading /proc/708/cmdline xdf.mpsl File opened for reading /proc/794/cmdline xdf.mpsl File opened for reading /proc/817/cmdline xdf.mpsl File opened for reading /proc/13/cmdline xdf.mpsl File opened for reading /proc/19/cmdline xdf.mpsl File opened for reading /proc/23/cmdline xdf.mpsl File opened for reading /proc/409/cmdline xdf.mpsl File opened for reading /proc/662/cmdline xdf.mpsl File opened for reading /proc/764/cmdline xdf.mpsl File opened for reading /proc/773/cmdline xdf.mpsl File opened for reading /proc/14/cmdline xdf.mpsl File opened for reading /proc/18/cmdline xdf.mpsl File opened for reading /proc/31/cmdline xdf.mpsl File opened for reading /proc/53/cmdline xdf.mpsl File opened for reading /proc/59/cmdline xdf.mpsl File opened for reading /proc/2/cmdline xdf.mpsl File opened for reading /proc/9/cmdline xdf.mpsl File opened for reading /proc/30/cmdline xdf.mpsl File opened for reading /proc/32/cmdline xdf.mpsl File opened for reading /proc/42/cmdline xdf.mpsl File opened for reading /proc/3/cmdline xdf.mpsl File opened for reading /proc/5/cmdline xdf.mpsl File opened for reading /proc/20/cmdline xdf.mpsl File opened for reading /proc/26/cmdline xdf.mpsl File opened for reading /proc/700/cmdline xdf.mpsl File opened for reading /proc/7/cmdline xdf.mpsl File opened for reading /proc/10/cmdline xdf.mpsl File opened for reading /proc/24/cmdline xdf.mpsl File opened for reading /proc/37/cmdline xdf.mpsl File opened for reading /proc/118/cmdline xdf.mpsl File opened for reading /proc/370/cmdline xdf.mpsl File opened for reading /proc/761/cmdline xdf.mpsl File opened for reading /proc/807/cmdline xdf.mpsl File opened for reading /proc/11/cmdline xdf.mpsl File opened for reading /proc/48/cmdline xdf.mpsl File opened for reading /proc/203/cmdline xdf.mpsl File opened for reading /proc/762/cmdline xdf.mpsl File opened for reading /proc/778/cmdline xdf.mpsl File opened for reading /proc/21/cmdline xdf.mpsl File opened for reading /proc/678/cmdline xdf.mpsl File opened for reading /proc/856/cmdline xdf.mpsl File opened for reading /proc/22/cmdline xdf.mpsl File opened for reading /proc/109/cmdline xdf.mpsl File opened for reading /proc/792/cmdline xdf.mpsl File opened for reading /proc/44/cmdline xdf.mpsl File opened for reading /proc/58/cmdline xdf.mpsl File opened for reading /proc/112/cmdline xdf.mpsl File opened for reading /proc/119/cmdline xdf.mpsl File opened for reading /proc/369/cmdline xdf.mpsl File opened for reading /proc/114/cmdline xdf.mpsl File opened for reading /proc/8/cmdline xdf.mpsl File opened for reading /proc/17/cmdline xdf.mpsl File opened for reading /proc/29/cmdline xdf.mpsl File opened for reading /proc/33/cmdline xdf.mpsl