Analysis
- max time kernel
152s - max time network
158s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
04/08/2026, 06:36
Behavioral task
behavioral1
Sample
nz.mpsl.elf
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
5 signatures
150 seconds
General
- Target nz.mpsl.elf
- Size 51KB
- Sample260804-hc395starg
- SHA256 769fcbb7d814d067fced470328682301f7f78353cd34160c8edb7ef9bc7d6b60
- MD5 76b3d2a55dab91cb1ef2846450662bd1
- SHA1 cbe30be3501b5ffd7b26f72f3aed8ecb34b7888c
- SHA512 5440022e6627cb44c3d4a10b789dc8c74f28a29e94350f1ae6133d9dec5693d7cfbaa1512ab23ec0b2f05bc808a1c8c38a9b19d45a17c468198f8b2fae73af2f
- SSDEEP 768:eGlBv/MzvwbSRbrBZougf8wABOIqK+1wDCP2UW8DfOodxGnFybTZ+Db8Hqy1+Tgh:eGlhMMbSRb0d8irdMqW8LxGnHDb8F0gh
- TLSH T1A833F2DDE6DA101BCB3D0D7B90EC96A04D4B3480B1EAAF49474115CADE59D0E7ACF2AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
s3o65awrf56.net
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog nz.mpsl.elf File opened for modification /dev/watchdog nz.mpsl.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.mpsl.elf File opened for modification /bin/watchdog nz.mpsl.elf -
description ioc Process File opened for reading /proc/11/status nz.mpsl.elf File opened for reading /proc/19/status nz.mpsl.elf File opened for reading /proc/395/status nz.mpsl.elf File opened for reading /proc/663/status nz.mpsl.elf File opened for reading /proc/12/status nz.mpsl.elf File opened for reading /proc/14/status nz.mpsl.elf File opened for reading /proc/26/status nz.mpsl.elf File opened for reading /proc/29/status nz.mpsl.elf File opened for reading /proc/59/status nz.mpsl.elf File opened for reading /proc/379/status nz.mpsl.elf File opened for reading /proc/678/status nz.mpsl.elf File opened for reading /proc/23/status nz.mpsl.elf File opened for reading /proc/42/status nz.mpsl.elf File opened for reading /proc/433/status nz.mpsl.elf File opened for reading /proc/767/status nz.mpsl.elf File opened for reading /proc/24/status nz.mpsl.elf File opened for reading /proc/114/status nz.mpsl.elf File opened for reading /proc/377/status nz.mpsl.elf File opened for reading /proc/697/status nz.mpsl.elf File opened for reading /proc/28/status nz.mpsl.elf File opened for reading /proc/4/status nz.mpsl.elf File opened for reading /proc/765/status nz.mpsl.elf File opened for reading /proc/390/status nz.mpsl.elf File opened for reading /proc/807/status nz.mpsl.elf File opened for reading /proc/809/status nz.mpsl.elf File opened for reading /proc/9/status nz.mpsl.elf File opened for reading /proc/15/status nz.mpsl.elf File opened for reading /proc/17/status nz.mpsl.elf File opened for reading /proc/18/status nz.mpsl.elf File opened for reading /proc/34/status nz.mpsl.elf File opened for reading /proc/48/status nz.mpsl.elf File opened for reading /proc/782/status nz.mpsl.elf File opened for reading /proc/2/status nz.mpsl.elf File opened for reading /proc/3/status nz.mpsl.elf File opened for reading /proc/7/status nz.mpsl.elf File opened for reading /proc/53/status nz.mpsl.elf File opened for reading /proc/137/status nz.mpsl.elf File opened for reading /proc/677/status nz.mpsl.elf File opened for reading /proc/778/status nz.mpsl.elf File opened for reading /proc/811/status nz.mpsl.elf File opened for reading /proc/180/status nz.mpsl.elf File opened for reading /proc/6/status nz.mpsl.elf File opened for reading /proc/13/status nz.mpsl.elf File opened for reading /proc/16/status nz.mpsl.elf File opened for reading /proc/118/status nz.mpsl.elf File opened for reading /proc/380/status nz.mpsl.elf File opened for reading /proc/762/status nz.mpsl.elf File opened for reading /proc/812/status nz.mpsl.elf File opened for reading /proc/1/status nz.mpsl.elf File opened for reading /proc/21/status nz.mpsl.elf File opened for reading /proc/31/status nz.mpsl.elf File opened for reading /proc/35/status nz.mpsl.elf File opened for reading /proc/802/status nz.mpsl.elf File opened for reading /proc/20/status nz.mpsl.elf File opened for reading /proc/37/status nz.mpsl.elf File opened for reading /proc/113/status nz.mpsl.elf File opened for reading /proc/813/status nz.mpsl.elf File opened for reading /proc/5/status nz.mpsl.elf File opened for reading /proc/22/status nz.mpsl.elf File opened for reading /proc/30/status nz.mpsl.elf File opened for reading /proc/119/status nz.mpsl.elf File opened for reading /proc/409/status nz.mpsl.elf File opened for reading /proc/703/status nz.mpsl.elf File opened for reading /proc/10/status nz.mpsl.elf