Analysis
- max time kernel
151s - max time network
146s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
23/06/2026, 04:25
Static task
static1
Behavioral task
behavioral1
Sample
sora.mpsl.elf
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
4 signatures
150 seconds
General
- Target sora.mpsl.elf
- Size 240KB
- Sample260623-e2dh8saw41
- SHA256 d53aa239f125bd4442532f1e2e7ae09919460a453d06aefa180b588e1c78cf9e
- MD5 9b3b935d95e2857f1dde1d3b6ea20038
- SHA1 47358f27e887caa2800896c8ef9a2559f1b91f11
- SHA512 f61394b7896754faba5b4e3cf4a01d8774bdf07d2ba412bcaafc762543da484be7cf5e971faf431861cf5b3cb07edabb5a35004c1aeba92d64439b76dcc1b1a6
- SSDEEP 3072:vYSrl2E66hqM/++ruTPrGTpKoW4Kl+g58WE1AqA:v8JBM/VrMeMoufxZqA
- TLSH T13E34E80AAB610FFBDC6BDD3702E91B0525CC641722A52F367278DA18F94A64F46D3C78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 804 sora.mpsl.elf - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog sora.mpsl.elf File opened for modification /dev/misc/watchdog sora.mpsl.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself scanbot 804 sora.mpsl.elf -
description ioc Process File opened for reading /proc/833cmdline sora.mpsl.elf File opened for reading /proc/840cmdline sora.mpsl.elf File opened for reading /proc/3cmdline sora.mpsl.elf File opened for reading /proc/14cmdline sora.mpsl.elf File opened for reading /proc/333cmdline sora.mpsl.elf File opened for reading /proc/409cmdline sora.mpsl.elf File opened for reading /proc/663cmdline sora.mpsl.elf File opened for reading /proc/834cmdline sora.mpsl.elf File opened for reading /proc/835cmdline sora.mpsl.elf File opened for reading /proc/110cmdline sora.mpsl.elf File opened for reading /proc/114cmdline sora.mpsl.elf File opened for reading /proc/138cmdline sora.mpsl.elf File opened for reading /proc/180cmdline sora.mpsl.elf File opened for reading /proc/382cmdline sora.mpsl.elf File opened for reading /proc/820cmdline sora.mpsl.elf File opened for reading /proc/825cmdline sora.mpsl.elf File opened for reading /proc/837cmdline sora.mpsl.elf File opened for reading /proc/25cmdline sora.mpsl.elf File opened for reading /proc/765cmdline sora.mpsl.elf File opened for reading /proc/807cmdline sora.mpsl.elf File opened for reading /proc/814cmdline sora.mpsl.elf File opened for reading /proc/824cmdline sora.mpsl.elf File opened for reading /proc/828cmdline sora.mpsl.elf File opened for reading /proc/829cmdline sora.mpsl.elf File opened for reading /proc/836cmdline sora.mpsl.elf File opened for reading /proc/24cmdline sora.mpsl.elf File opened for reading /proc/31cmdline sora.mpsl.elf File opened for reading /proc/118cmdline sora.mpsl.elf File opened for reading /proc/202cmdline sora.mpsl.elf File opened for reading /proc/768cmdline sora.mpsl.elf File opened for reading /proc/795cmdline sora.mpsl.elf File opened for reading /proc/797cmdline sora.mpsl.elf File opened for reading /proc/798cmdline sora.mpsl.elf File opened for reading /proc/11cmdline sora.mpsl.elf File opened for reading /proc/16cmdline sora.mpsl.elf File opened for reading /proc/23cmdline sora.mpsl.elf File opened for reading /proc/44cmdline sora.mpsl.elf File opened for reading /proc/677cmdline sora.mpsl.elf File opened for reading /proc/809cmdline sora.mpsl.elf File opened for reading /proc/816cmdline sora.mpsl.elf File opened for reading /proc/818cmdline sora.mpsl.elf File opened for reading /proc/10cmdline sora.mpsl.elf File opened for reading /proc/30cmdline sora.mpsl.elf File opened for reading /proc/37cmdline sora.mpsl.elf File opened for reading /proc/119cmdline sora.mpsl.elf File opened for reading /proc/392cmdline sora.mpsl.elf File opened for reading /proc/7cmdline sora.mpsl.elf File opened for reading /proc/17cmdline sora.mpsl.elf File opened for reading /proc/26cmdline sora.mpsl.elf File opened for reading /proc/33cmdline sora.mpsl.elf File opened for reading /proc/34cmdline sora.mpsl.elf File opened for reading /proc/53cmdline sora.mpsl.elf File opened for reading /proc/58cmdline sora.mpsl.elf File opened for reading /proc/380cmdline sora.mpsl.elf File opened for reading /proc/4cmdline sora.mpsl.elf File opened for reading /proc/9cmdline sora.mpsl.elf File opened for reading /proc/22cmdline sora.mpsl.elf File opened for reading /proc/59cmdline sora.mpsl.elf File opened for reading /proc/397cmdline sora.mpsl.elf File opened for reading /proc/764cmdline sora.mpsl.elf File opened for reading /proc/794cmdline sora.mpsl.elf File opened for reading /proc/810cmdline sora.mpsl.elf File opened for reading /proc/337cmdline sora.mpsl.elf File opened for reading /proc/2cmdline sora.mpsl.elf