Analysis
- max time kernel
152s - max time network
161s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
22/05/2026, 18:13
Static task
static1
Behavioral task
behavioral1
Sample
phantom.mpsl
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
4 signatures
150 seconds
General
- Target phantom.mpsl
- Size 7.8MB
- Sample260522-wtppzacw7j
- SHA256 899375bda6b89b18d99f4c4e8f14cacf28dcd135f7091b3948aa9cee104d4ae1
- MD5 a45bbca1a4c0acf94f39b31b1675e12e
- SHA1 abb11006f5ec996c0f9c41ac00bbcb7a4a2715fb
- SHA512 7a8fe7b6d618342d9917a6748098699a773a7f387de8fbf784c7c73412f64ceb867c00b1a440237d31e9d0b1f4772e3a5f42ea4aaefa4342a9e4454cf3333a35
- SSDEEP 49152:2DLGNhCbCRCfWDWOw0CQBWWbh+4vCaIE17Il8Zw7GgZ5Em:XULQBHLImDy7jPEm
- TLSH T12D860805ADC53BE6C42C5E7444EACA5522B06D140AF24A3A26A4FFEDBC762757F078CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /lib/systemd/systemd-udevd 803 phantom.mpsl - Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size phantom.mpsl File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max phantom.mpsl -
description ioc Process File opened for reading /proc/111/stat phantom.mpsl File opened for reading /proc/137/stat phantom.mpsl File opened for reading /proc/35/environ phantom.mpsl File opened for reading /proc/37/stat phantom.mpsl File opened for reading /proc/9/environ phantom.mpsl File opened for reading /proc/12/environ phantom.mpsl File opened for reading /proc/22/stat phantom.mpsl File opened for reading /proc/664/environ phantom.mpsl File opened for reading /proc/8/stat phantom.mpsl File opened for reading /proc/17/stat phantom.mpsl File opened for reading /proc/26/stat phantom.mpsl File opened for reading /proc/48/environ phantom.mpsl File opened for reading /proc/5/stat phantom.mpsl File opened for reading /proc/113/stat phantom.mpsl File opened for reading /proc/27/stat phantom.mpsl File opened for reading /proc/4/environ phantom.mpsl File opened for reading /proc/53/environ phantom.mpsl File opened for reading /proc/6/environ phantom.mpsl File opened for reading /proc/7/stat phantom.mpsl File opened for reading /proc/9/stat phantom.mpsl File opened for reading /proc/136/environ phantom.mpsl File opened for reading /proc/25/environ phantom.mpsl File opened for reading /proc/59/environ phantom.mpsl File opened for reading /proc/816/stat phantom.mpsl File opened for reading /proc/118/stat phantom.mpsl File opened for reading /proc/34/stat phantom.mpsl File opened for reading /proc/self/mountinfo phantom.mpsl File opened for reading /proc/113/environ phantom.mpsl File opened for reading /proc/115/environ phantom.mpsl File opened for reading /proc/2/environ phantom.mpsl File opened for reading /proc/48/stat phantom.mpsl File opened for reading /proc/24/stat phantom.mpsl File opened for reading /proc/47/environ phantom.mpsl File opened for reading /proc/58/environ phantom.mpsl File opened for reading /proc/14/stat phantom.mpsl File opened for reading /proc/787/stat phantom.mpsl File opened for reading /proc/788/environ phantom.mpsl File opened for reading /proc/22/environ phantom.mpsl File opened for reading /proc/32/stat phantom.mpsl File opened for reading /proc/17/environ phantom.mpsl File opened for reading /proc/6/stat phantom.mpsl File opened for reading /proc/816/environ phantom.mpsl File opened for reading /proc/11/stat phantom.mpsl File opened for reading /proc/53/stat phantom.mpsl File opened for reading /proc/10/environ phantom.mpsl File opened for reading /proc/26/environ phantom.mpsl File opened for reading /proc/111/environ phantom.mpsl File opened for reading /proc/112/environ phantom.mpsl File opened for reading /proc/15/environ phantom.mpsl File opened for reading /proc/32/environ phantom.mpsl File opened for reading /proc/42/stat phantom.mpsl File opened for reading /proc/773/stat phantom.mpsl File opened for reading /proc/788/stat phantom.mpsl File opened for reading /proc/12/stat phantom.mpsl File opened for reading /proc/20/environ phantom.mpsl File opened for reading /proc/44/stat phantom.mpsl File opened for reading /proc/self/cgroup phantom.mpsl File opened for reading /proc/27/environ phantom.mpsl File opened for reading /proc/31/environ phantom.mpsl File opened for reading /proc/664/stat phantom.mpsl File opened for reading /proc/778/environ phantom.mpsl File opened for reading /proc/778/stat phantom.mpsl File opened for reading /proc/19/environ phantom.mpsl File opened for reading /proc/29/stat phantom.mpsl