Analysis
- max time kernel
136s - max time network
152s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
03/08/2026, 00:46
Behavioral task
behavioral1
Sample
nz.mpsl.elf
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
5 signatures
150 seconds
General
- Target nz.mpsl.elf
- Size 51KB
- Sample260803-a4t7jsaa82
- SHA256 b46800eb4eb3fbc6decc75bad5ebb5b400e27200c50da23199bd1f6a07537820
- MD5 5927426cf05a4b5fd0410a55b6236936
- SHA1 fc9113f3f04609cd5dbaf391d75585d3b5d9c91e
- SHA512 9c415412c8c2693cfcd32e6bdcad76533090d45928633691101b7306125ea5e475edf8b93413c995159b28572d340bbc2db1c9e722b9121400cb1dd601a8933d
- SSDEEP 768:A82KPy+WUJ1G4GcPXqa7itQ2Rn/arWaY3eRV014fw/J2B9YszEKSmskTAJOTWG:5LK+Neavqdpaqvev014f+JS/Fjzj
- TLSH T1B333F18CBCE1794AE969027243CE0F514A602575719F878E670586CEF6DE32FE80A1F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
s3o65awrf56.net
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog nz.mpsl.elf File opened for modification /dev/watchdog nz.mpsl.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /bin/watchdog nz.mpsl.elf File opened for modification /sbin/watchdog nz.mpsl.elf -
description ioc Process File opened for reading /proc/47/status nz.mpsl.elf File opened for reading /proc/4/status nz.mpsl.elf File opened for reading /proc/10/status nz.mpsl.elf File opened for reading /proc/203/status nz.mpsl.elf File opened for reading /proc/8/status nz.mpsl.elf File opened for reading /proc/59/status nz.mpsl.elf File opened for reading /proc/389/status nz.mpsl.elf File opened for reading /proc/433/status nz.mpsl.elf File opened for reading /proc/679/status nz.mpsl.elf File opened for reading /proc/798/status nz.mpsl.elf File opened for reading /proc/30/status nz.mpsl.elf File opened for reading /proc/42/status nz.mpsl.elf File opened for reading /proc/44/status nz.mpsl.elf File opened for reading /proc/797/status nz.mpsl.elf File opened for reading /proc/807/status nz.mpsl.elf File opened for reading /proc/317/status nz.mpsl.elf File opened for reading /proc/5/status nz.mpsl.elf File opened for reading /proc/11/status nz.mpsl.elf File opened for reading /proc/13/status nz.mpsl.elf File opened for reading /proc/14/status nz.mpsl.elf File opened for reading /proc/25/status nz.mpsl.elf File opened for reading /proc/35/status nz.mpsl.elf File opened for reading /proc/48/status nz.mpsl.elf File opened for reading /proc/3/status nz.mpsl.elf File opened for reading /proc/6/status nz.mpsl.elf File opened for reading /proc/18/status nz.mpsl.elf File opened for reading /proc/26/status nz.mpsl.elf File opened for reading /proc/113/status nz.mpsl.elf File opened for reading /proc/179/status nz.mpsl.elf File opened for reading /proc/58/status nz.mpsl.elf File opened for reading /proc/660/status nz.mpsl.elf File opened for reading /proc/376/status nz.mpsl.elf File opened for reading /proc/19/status nz.mpsl.elf File opened for reading /proc/32/status nz.mpsl.elf File opened for reading /proc/112/status nz.mpsl.elf File opened for reading /proc/136/status nz.mpsl.elf File opened for reading /proc/808/status nz.mpsl.elf File opened for reading /proc/17/status nz.mpsl.elf File opened for reading /proc/27/status nz.mpsl.elf File opened for reading /proc/53/status nz.mpsl.elf File opened for reading /proc/379/status nz.mpsl.elf File opened for reading /proc/698/status nz.mpsl.elf File opened for reading /proc/703/status nz.mpsl.elf File opened for reading /proc/763/status nz.mpsl.elf File opened for reading /proc/766/status nz.mpsl.elf File opened for reading /proc/21/status nz.mpsl.elf File opened for reading /proc/378/status nz.mpsl.elf File opened for reading /proc/393/status nz.mpsl.elf File opened for reading /proc/809/status nz.mpsl.elf File opened for reading /proc/114/status nz.mpsl.elf File opened for reading /proc/137/status nz.mpsl.elf File opened for reading /proc/340/status nz.mpsl.elf File opened for reading /proc/779/status nz.mpsl.elf File opened for reading /proc/29/status nz.mpsl.elf File opened for reading /proc/115/status nz.mpsl.elf File opened for reading /proc/404/status nz.mpsl.elf File opened for reading /proc/678/status nz.mpsl.elf File opened for reading /proc/804/status nz.mpsl.elf File opened for reading /proc/20/status nz.mpsl.elf File opened for reading /proc/22/status nz.mpsl.elf File opened for reading /proc/726/status nz.mpsl.elf File opened for reading /proc/117/status nz.mpsl.elf File opened for reading /proc/2/status nz.mpsl.elf File opened for reading /proc/9/status nz.mpsl.elf