Analysis
- max time kernel
124s - max time network
156s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
20/07/2026, 01:04
Behavioral task
behavioral1
Sample
nz.mpsl.elf
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
4 signatures
150 seconds
General
- Target nz.mpsl.elf
- Size 115KB
- Sample260720-bfeydsdv6s
- SHA256 acdc1b5cfe4a154fd2c3de022622508a402d2d12927f26e67d5e77c3c92e267b
- MD5 8aab58e571a6e145139ddb1f3b6fe4f6
- SHA1 91aef41c0fba8e9af6f20a23e9a04dae159abf72
- SHA512 c685dfeb599dd405874ed88ea45146e78d178f75dd18817a273c9df083edce0338e585fc3e6139e76e107f1f8bfb717fbc611542f6174fbf3fb2a4062481e48c
- SSDEEP 3072:bdub7djS5HECh6Qb1ShRhFczcmVRh865xP:bdo7djS5ECJSozcmVRbP
- TLSH T191B3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog nz.mpsl.elf File opened for modification /dev/watchdog nz.mpsl.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.mpsl.elf File opened for modification /bin/watchdog nz.mpsl.elf -
description ioc Process File opened for reading /proc/30/status nz.mpsl.elf File opened for reading /proc/31/status nz.mpsl.elf File opened for reading /proc/801/status nz.mpsl.elf File opened for reading /proc/14/status nz.mpsl.elf File opened for reading /proc/24/status nz.mpsl.elf File opened for reading /proc/25/status nz.mpsl.elf File opened for reading /proc/26/status nz.mpsl.elf File opened for reading /proc/44/status nz.mpsl.elf File opened for reading /proc/115/status nz.mpsl.elf File opened for reading /proc/398/status nz.mpsl.elf File opened for reading /proc/28/status nz.mpsl.elf File opened for reading /proc/4/status nz.mpsl.elf File opened for reading /proc/10/status nz.mpsl.elf File opened for reading /proc/17/status nz.mpsl.elf File opened for reading /proc/114/status nz.mpsl.elf File opened for reading /proc/676/status nz.mpsl.elf File opened for reading /proc/2/status nz.mpsl.elf File opened for reading /proc/9/status nz.mpsl.elf File opened for reading /proc/19/status nz.mpsl.elf File opened for reading /proc/53/status nz.mpsl.elf File opened for reading /proc/137/status nz.mpsl.elf File opened for reading /proc/376/status nz.mpsl.elf File opened for reading /proc/761/status nz.mpsl.elf File opened for reading /proc/779/status nz.mpsl.elf File opened for reading /proc/7/status nz.mpsl.elf File opened for reading /proc/118/status nz.mpsl.elf File opened for reading /proc/378/status nz.mpsl.elf File opened for reading /proc/797/status nz.mpsl.elf File opened for reading /proc/11/status nz.mpsl.elf File opened for reading /proc/22/status nz.mpsl.elf File opened for reading /proc/47/status nz.mpsl.elf File opened for reading /proc/793/status nz.mpsl.elf File opened for reading /proc/804/status nz.mpsl.elf File opened for reading /proc/48/status nz.mpsl.elf File opened for reading /proc/201/status nz.mpsl.elf File opened for reading /proc/754/status nz.mpsl.elf File opened for reading /proc/774/status nz.mpsl.elf File opened for reading /proc/805/status nz.mpsl.elf File opened for reading /proc/8/status nz.mpsl.elf File opened for reading /proc/27/status nz.mpsl.elf File opened for reading /proc/29/status nz.mpsl.elf File opened for reading /proc/677/status nz.mpsl.elf File opened for reading /proc/59/status nz.mpsl.elf File opened for reading /proc/112/status nz.mpsl.elf File opened for reading /proc/767/status nz.mpsl.elf File opened for reading /proc/806/status nz.mpsl.elf File opened for reading /proc/1/status nz.mpsl.elf File opened for reading /proc/15/status nz.mpsl.elf File opened for reading /proc/20/status nz.mpsl.elf File opened for reading /proc/58/status nz.mpsl.elf File opened for reading /proc/389/status nz.mpsl.elf File opened for reading /proc/699/status nz.mpsl.elf File opened for reading /proc/706/status nz.mpsl.elf File opened for reading /proc/12/status nz.mpsl.elf File opened for reading /proc/35/status nz.mpsl.elf File opened for reading /proc/37/status nz.mpsl.elf File opened for reading /proc/321/status nz.mpsl.elf File opened for reading /proc/339/status nz.mpsl.elf File opened for reading /proc/3/status nz.mpsl.elf File opened for reading /proc/32/status nz.mpsl.elf File opened for reading /proc/34/status nz.mpsl.elf File opened for reading /proc/42/status nz.mpsl.elf File opened for reading /proc/113/status nz.mpsl.elf File opened for reading /proc/5/status nz.mpsl.elf