Analysis
- max time kernel
141s - max time network
152s - platform
debian-12_mipsel - resource
debian12-mipsel-20260126-en - resource tags
arch:mipselimage:debian12-mipsel-20260126-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
28/04/2026, 18:43
General
- Target manji.mpsl
- Size 115KB
- Sample260428-xcxvpadt7t
- SHA256 3aceefe39982a5eb27e374338eb36ce001663f710b0cbd8d37da619e253c31bc
- MD5 4a9838c7a08a7a73e7077b25787ef3a3
- SHA1 ebe9cc104cea4c871b35fabe6e19c55ebd5cc49a
- SHA512 01238d591e3e140d53cfc687aa408da67adcae9593862d5394d6532ec6685a65798f42744cf5b0310359a36e3cbb63d8ead963a0fe72e3eb922b5fc0347cc052
- SSDEEP 1536:D4w4zW/h4SZsqEznAXgiDSAP0/OojaXbzzZjCfPNXi/yRKkkI3SGG:UxW/rZsq8AI/3jarzzveqGG
- TLSH T11BC3D506BF114FF7D89BCD7346FA0B05258CB82B16B92B757534EC58B24A1CA1AE3874
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Traces itself 19 IoCs
Traces itself to prevent debugging attempts
pid Process 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl 805 manji.mpsl - Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself uhttpd 805 manji.mpsl Changes the process name, possibly in an attempt to hide itself busybox 805 manji.mpsl - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo manji.mpsl -
description ioc Process File opened for reading /proc/mounts manji.mpsl File opened for reading /proc/self/status manji.mpsl