Analysis
- max time kernel
151s - max time network
146s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
04/08/2026, 01:20
Behavioral task
behavioral1
Sample
nz.mpsl.elf
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
4 signatures
150 seconds
General
- Target nz.mpsl.elf
- Size 157KB
- Sample260804-bqa27atshs
- SHA256 ed65a36f8f803f764b2088a3702a33c47d12e253ba192f8b39e7cb7aef0d2d17
- MD5 75a4431a181d22f5dc64fcfd3e4e178a
- SHA1 87b8ff66d4a814bc79b96a58e553816c3a1a9e79
- SHA512 1610590269de898426cc5e55d575ba1772e5febc26510b2e230d2cd663ab59abba3bb6607f8caa9808c4c7a33bebd9259d694d6c4e8868b9923af689fe31fe92
- SSDEEP 3072:wt7RGZzswcT+NcdwLty5l6Gl7UxbGuyZtksf02mUzohWhIvH6:wpRGZzX0+NcdwLtKlTl7UxbGuyZtksfR
- TLSH T168F30905BB610EF7E85FCC3706E9270128CDA51622B97B76B534D858F64B28B26E3D70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.mpsl.elf File opened for modification /dev/misc/watchdog nz.mpsl.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.mpsl.elf File opened for modification /bin/watchdog nz.mpsl.elf -
description ioc Process File opened for reading /proc/1/status nz.mpsl.elf File opened for reading /proc/2/status nz.mpsl.elf File opened for reading /proc/6/status nz.mpsl.elf File opened for reading /proc/7/status nz.mpsl.elf File opened for reading /proc/202/status nz.mpsl.elf File opened for reading /proc/12/status nz.mpsl.elf File opened for reading /proc/58/status nz.mpsl.elf File opened for reading /proc/113/status nz.mpsl.elf File opened for reading /proc/678/status nz.mpsl.elf File opened for reading /proc/803/status nz.mpsl.elf File opened for reading /proc/10/status nz.mpsl.elf File opened for reading /proc/21/status nz.mpsl.elf File opened for reading /proc/26/status nz.mpsl.elf File opened for reading /proc/35/status nz.mpsl.elf File opened for reading /proc/53/status nz.mpsl.elf File opened for reading /proc/115/status nz.mpsl.elf File opened for reading /proc/662/status nz.mpsl.elf File opened for reading /proc/762/status nz.mpsl.elf File opened for reading /proc/16/status nz.mpsl.elf File opened for reading /proc/34/status nz.mpsl.elf File opened for reading /proc/116/status nz.mpsl.elf File opened for reading /proc/780/status nz.mpsl.elf File opened for reading /proc/830/status nz.mpsl.elf File opened for reading /proc/3/status nz.mpsl.elf File opened for reading /proc/19/status nz.mpsl.elf File opened for reading /proc/30/status nz.mpsl.elf File opened for reading /proc/15/status nz.mpsl.elf File opened for reading /proc/17/status nz.mpsl.elf File opened for reading /proc/25/status nz.mpsl.elf File opened for reading /proc/28/status nz.mpsl.elf File opened for reading /proc/48/status nz.mpsl.elf File opened for reading /proc/118/status nz.mpsl.elf File opened for reading /proc/355/status nz.mpsl.elf File opened for reading /proc/379/status nz.mpsl.elf File opened for reading /proc/13/status nz.mpsl.elf File opened for reading /proc/138/status nz.mpsl.elf File opened for reading /proc/349/status nz.mpsl.elf File opened for reading /proc/388/status nz.mpsl.elf File opened for reading /proc/399/status nz.mpsl.elf File opened for reading /proc/766/status nz.mpsl.elf File opened for reading /proc/825/status nz.mpsl.elf File opened for reading /proc/829/status nz.mpsl.elf File opened for reading /proc/9/status nz.mpsl.elf File opened for reading /proc/18/status nz.mpsl.elf File opened for reading /proc/29/status nz.mpsl.elf File opened for reading /proc/42/status nz.mpsl.elf File opened for reading /proc/45/status nz.mpsl.elf File opened for reading /proc/59/status nz.mpsl.elf File opened for reading /proc/137/status nz.mpsl.elf File opened for reading /proc/391/status nz.mpsl.elf File opened for reading /proc/22/status nz.mpsl.elf File opened for reading /proc/397/status nz.mpsl.elf File opened for reading /proc/679/status nz.mpsl.elf File opened for reading /proc/709/status nz.mpsl.elf File opened for reading /proc/802/status nz.mpsl.elf File opened for reading /proc/808/status nz.mpsl.elf File opened for reading /proc/27/status nz.mpsl.elf File opened for reading /proc/33/status nz.mpsl.elf File opened for reading /proc/380/status nz.mpsl.elf File opened for reading /proc/8/status nz.mpsl.elf File opened for reading /proc/24/status nz.mpsl.elf File opened for reading /proc/706/status nz.mpsl.elf File opened for reading /proc/807/status nz.mpsl.elf File opened for reading /proc/20/status nz.mpsl.elf