9f7c3a561af2df3425118bc93b2e9d986f42fa98005f9bdbc53b23d8c64a8aec

Analysis

max time kernel
151s
max time network
144s
platform
debian-12_mipsel
resource
debian12-mipsel-20260513-en
resource tags

arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
20/06/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mpsl
Size 120KB
Sample260620-ala1ysdw21
SHA256 9f7c3a561af2df3425118bc93b2e9d986f42fa98005f9bdbc53b23d8c64a8aec
MD5 b5b3e2ba3892b24a7ebd9ae78759cf9d
SHA1 6c8543a6d39faed887c38f94d69fc3e651adc201
SHA512 f25a1ded21b14131549dbaa7dae14f0d9493b9998bb1dacb2d8f8bf3875eb9ac38ee1d541b84bf8aeeab07dbf2b985dbb9a79c86584031b8d5af66bb19debef6
SSDEEP 1536:QhwCvdHmez3BK9LW05Biw6PmPQ4+efKmWhS4cUz9KrZ9nTDCV5bOvd7JMeN:MwCvdHmezn0nUPMu9KryXsMeN
TLSH
T160C3D60ABF210FFBD85FCD3B06A9170225CC555722E9BB3A7574C928F64A21B09D3DA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	mpsl
File opened for modification	/dev/misc/watchdog	mpsl

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	FoqRpoNjtAVnP	793	mpsl

/tmp/mpsl
/tmp/mpsl
1⤵
- Modifies Watchdog functionality
- Changes its process name
PID:793

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads