Analysis
- max time kernel
122s - max time network
85s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
02/08/2026, 12:23
Behavioral task
behavioral1
Sample
nz.mpsl
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
5 signatures
150 seconds
General
- Target nz.mpsl
- Size 52KB
- Sample260802-pkg57san6x
- SHA256 fe733770fdf210191e7713d57de50d4f8ae1e5a8935c1bdd24adeec5938f3250
- MD5 bf15538b132f3f581214898f50ba30f7
- SHA1 c487867d5a49ca6a8e5a725aa008bdb650a94f48
- SHA512 2be244f7a88c87924614d1a229669644b6b80ac3bb3bf34b94cd90c00042520e9b1642f9d38223da0ab52026c894e3833b30146071a61713ea6a3bf210bc69f3
- SSDEEP 768:u4ipTnIkhLCdKxSC6eLolRacJiX5pHp/PXhUJrwe3HJgryPpwFa1To0WtV:uR5nIWGsxSxhlHCfJXkrJHJgrACFaa
- TLSH T16B33020ED62644ACCE4CDFF7C18A7F3528C075D1135E9F5D53131960B63A28CA61D2A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
jkqhdbbbqwiujkaz.hopto.org
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.mpsl File opened for modification /dev/misc/watchdog nz.mpsl - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.mpsl File opened for modification /bin/watchdog nz.mpsl -
description ioc Process File opened for reading /proc/5/status nz.mpsl File opened for reading /proc/6/status nz.mpsl File opened for reading /proc/10/status nz.mpsl File opened for reading /proc/15/status nz.mpsl File opened for reading /proc/760/status nz.mpsl File opened for reading /proc/764/status nz.mpsl File opened for reading /proc/810/status nz.mpsl File opened for reading /proc/21/status nz.mpsl File opened for reading /proc/30/status nz.mpsl File opened for reading /proc/114/status nz.mpsl File opened for reading /proc/20/status nz.mpsl File opened for reading /proc/34/status nz.mpsl File opened for reading /proc/766/status nz.mpsl File opened for reading /proc/797/status nz.mpsl File opened for reading /proc/378/status nz.mpsl File opened for reading /proc/18/status nz.mpsl File opened for reading /proc/25/status nz.mpsl File opened for reading /proc/1/status nz.mpsl File opened for reading /proc/4/status nz.mpsl File opened for reading /proc/53/status nz.mpsl File opened for reading /proc/661/status nz.mpsl File opened for reading /proc/799/status nz.mpsl File opened for reading /proc/23/status nz.mpsl File opened for reading /proc/32/status nz.mpsl File opened for reading /proc/59/status nz.mpsl File opened for reading /proc/135/status nz.mpsl File opened for reading /proc/27/status nz.mpsl File opened for reading /proc/35/status nz.mpsl File opened for reading /proc/37/status nz.mpsl File opened for reading /proc/45/status nz.mpsl File opened for reading /proc/58/status nz.mpsl File opened for reading /proc/112/status nz.mpsl File opened for reading /proc/809/status nz.mpsl File opened for reading /proc/26/status nz.mpsl File opened for reading /proc/47/status nz.mpsl File opened for reading /proc/115/status nz.mpsl File opened for reading /proc/200/status nz.mpsl File opened for reading /proc/19/status nz.mpsl File opened for reading /proc/3/status nz.mpsl File opened for reading /proc/31/status nz.mpsl File opened for reading /proc/42/status nz.mpsl File opened for reading /proc/392/status nz.mpsl File opened for reading /proc/2/status nz.mpsl File opened for reading /proc/9/status nz.mpsl File opened for reading /proc/136/status nz.mpsl File opened for reading /proc/375/status nz.mpsl File opened for reading /proc/694/status nz.mpsl File opened for reading /proc/782/status nz.mpsl File opened for reading /proc/8/status nz.mpsl File opened for reading /proc/12/status nz.mpsl File opened for reading /proc/796/status nz.mpsl File opened for reading /proc/812/status nz.mpsl File opened for reading /proc/813/status nz.mpsl File opened for reading /proc/175/status nz.mpsl File opened for reading /proc/377/status nz.mpsl File opened for reading /proc/11/status nz.mpsl File opened for reading /proc/29/status nz.mpsl File opened for reading /proc/33/status nz.mpsl File opened for reading /proc/697/status nz.mpsl File opened for reading /proc/724/status nz.mpsl File opened for reading /proc/805/status nz.mpsl File opened for reading /proc/334/status nz.mpsl File opened for reading /proc/415/status nz.mpsl File opened for reading /proc/676/status nz.mpsl