Analysis
- max time kernel
40s - max time network
38s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
04/08/2026, 03:44
Behavioral task
behavioral1
Sample
nz.mpsl
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
4 signatures
40 seconds
General
- Target nz.mpsl
- Size 157KB
- Sample260804-eahnwace34
- SHA256 0574668a554ae3b033d5fe025fd32c7d22c1308eb93cda1ac45759d9c42d5cbb
- MD5 35d4d5bb045a33c8d5f29a793a34a932
- SHA1 5fbfada6f94911767b3c8d465ba37addab5a677c
- SHA512 ebf06762a97c65d769d140768d73af7f1e0b708e84f560264a8b6c9e14ed34960edf492f2d39fc604f64e44c451e9f586be003afe3d116bb697c65df957dabae
- SSDEEP 3072:Wdrx+Fzsw8TONAdQLty5l6Gm7UxbiuyZo9RlLP4FQQm8DrfWH6:WJx+FzXUONAdQLtKlTm7UxbiuyZORlLm
- TLSH T1E9F3F805BB610EF7E85FCC3706E9270128CDA51622A97F36B534D958F64B28B26E3D70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog nz.mpsl File opened for modification /dev/watchdog nz.mpsl - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.mpsl File opened for modification /bin/watchdog nz.mpsl -
description ioc Process File opened for reading /proc/1/status nz.mpsl File opened for reading /proc/31/status nz.mpsl File opened for reading /proc/112/status nz.mpsl File opened for reading /proc/114/status nz.mpsl File opened for reading /proc/334/status nz.mpsl File opened for reading /proc/349/status nz.mpsl File opened for reading /proc/32/status nz.mpsl File opened for reading /proc/180/status nz.mpsl File opened for reading /proc/206/status nz.mpsl File opened for reading /proc/800/status nz.mpsl File opened for reading /proc/137/status nz.mpsl File opened for reading /proc/682/status nz.mpsl File opened for reading /proc/12/status nz.mpsl File opened for reading /proc/21/status nz.mpsl File opened for reading /proc/8/status nz.mpsl File opened for reading /proc/15/status nz.mpsl File opened for reading /proc/30/status nz.mpsl File opened for reading /proc/58/status nz.mpsl File opened for reading /proc/59/status nz.mpsl File opened for reading /proc/246/status nz.mpsl File opened for reading /proc/53/status nz.mpsl File opened for reading /proc/113/status nz.mpsl File opened for reading /proc/417/status nz.mpsl File opened for reading /proc/662/status nz.mpsl File opened for reading /proc/797/status nz.mpsl File opened for reading /proc/2/status nz.mpsl File opened for reading /proc/4/status nz.mpsl File opened for reading /proc/6/status nz.mpsl File opened for reading /proc/17/status nz.mpsl File opened for reading /proc/37/status nz.mpsl File opened for reading /proc/776/status nz.mpsl File opened for reading /proc/9/status nz.mpsl File opened for reading /proc/117/status nz.mpsl File opened for reading /proc/264/status nz.mpsl File opened for reading /proc/692/status nz.mpsl File opened for reading /proc/25/status nz.mpsl File opened for reading /proc/26/status nz.mpsl File opened for reading /proc/33/status nz.mpsl File opened for reading /proc/5/status nz.mpsl File opened for reading /proc/42/status nz.mpsl File opened for reading /proc/47/status nz.mpsl File opened for reading /proc/370/status nz.mpsl File opened for reading /proc/393/status nz.mpsl File opened for reading /proc/10/status nz.mpsl File opened for reading /proc/13/status nz.mpsl File opened for reading /proc/20/status nz.mpsl File opened for reading /proc/22/status nz.mpsl File opened for reading /proc/24/status nz.mpsl File opened for reading /proc/45/status nz.mpsl File opened for reading /proc/796/status nz.mpsl File opened for reading /proc/799/status nz.mpsl File opened for reading /proc/18/status nz.mpsl File opened for reading /proc/27/status nz.mpsl File opened for reading /proc/344/status nz.mpsl File opened for reading /proc/791/status nz.mpsl File opened for reading /proc/801/status nz.mpsl File opened for reading /proc/35/status nz.mpsl File opened for reading /proc/48/status nz.mpsl File opened for reading /proc/115/status nz.mpsl File opened for reading /proc/136/status nz.mpsl File opened for reading /proc/761/status nz.mpsl File opened for reading /proc/794/status nz.mpsl File opened for reading /proc/7/status nz.mpsl File opened for reading /proc/14/status nz.mpsl