Analysis
- max time kernel
153s - max time network
160s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
04/08/2026, 12:12
Behavioral task
behavioral1
Sample
pmpsl
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
5 signatures
150 seconds
General
- Target pmpsl
- Size 39KB
- Sample260804-pda4baek2w
- SHA256 c426a53c573f96f4c509fca91a1802890c96caa6b25c3bbc6e11869d16ffc8ec
- MD5 3c0bb7f93c56aa144b8707a91f728773
- SHA1 30c9f1d74bc44b074d1f2bec694287dbe73848e5
- SHA512 c7d838981b68388dd1432d5c91bb686ea36a9647c2a8eb750f5d10459311fdf3aacca24523188254340e3c80a425507a06be6c15fbba8e6f43a563317645a6a4
- SSDEEP 768:eYbMN2q8qb06Ds/hpZGsQDkmEuwotvd7thEo26AhrRHny5Wc:eYgzPb0UsHmE4d79Ah1Hnyn
- TLSH T1ED03E1DCF2F46D57EA8D2C36316913776B20B1D3665E1675130248C8CE8D74E7F098AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
MIRAI
Signatures
- Deletes itself 1 IoCs
pid Process 796 pmpsl - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog pmpsl File opened for modification /dev/misc/watchdog pmpsl - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself 0sre4qfq4qdau35tsuw8f7oebtt7 796 pmpsl -
description ioc Process File opened for reading /proc/1cmdline pmpsl File opened for reading /proc/22cmdline pmpsl File opened for reading /proc/137cmdline pmpsl File opened for reading /proc/393cmdline pmpsl File opened for reading /proc/773cmdline pmpsl File opened for reading /proc/785cmdline pmpsl File opened for reading /proc/805cmdline pmpsl File opened for reading /proc/827cmdline pmpsl File opened for reading /proc/830cmdline pmpsl File opened for reading /proc/5cmdline pmpsl File opened for reading /proc/16cmdline pmpsl File opened for reading /proc/47cmdline pmpsl File opened for reading /proc/115cmdline pmpsl File opened for reading /proc/821cmdline pmpsl File opened for reading /proc/825cmdline pmpsl File opened for reading /proc/838cmdline pmpsl File opened for reading /proc/11cmdline pmpsl File opened for reading /proc/12cmdline pmpsl File opened for reading /proc/786cmdline pmpsl File opened for reading /proc/845cmdline pmpsl File opened for reading /proc/334cmdline pmpsl File opened for reading /proc/766cmdline pmpsl File opened for reading /proc/829cmdline pmpsl File opened for reading /proc/849cmdline pmpsl File opened for reading /proc/850cmdline pmpsl File opened for reading /proc/865cmdline pmpsl File opened for reading /proc/264cmdline pmpsl File opened for reading /proc/831cmdline pmpsl File opened for reading /proc/866cmdline pmpsl File opened for reading /proc/9cmdline pmpsl File opened for reading /proc/59cmdline pmpsl File opened for reading /proc/114cmdline pmpsl File opened for reading /proc/662cmdline pmpsl File opened for reading /proc/349cmdline pmpsl File opened for reading /proc/682cmdline pmpsl File opened for reading /proc/761cmdline pmpsl File opened for reading /proc/807cmdline pmpsl File opened for reading /proc/823cmdline pmpsl File opened for reading /proc/856cmdline pmpsl File opened for reading /proc/34cmdline pmpsl File opened for reading /proc/37cmdline pmpsl File opened for reading /proc/824cmdline pmpsl File opened for reading /proc/29cmdline pmpsl File opened for reading /proc/31cmdline pmpsl File opened for reading /proc/58cmdline pmpsl File opened for reading /proc/136cmdline pmpsl File opened for reading /proc/822cmdline pmpsl File opened for reading /proc/837cmdline pmpsl File opened for reading /proc/3cmdline pmpsl File opened for reading /proc/775cmdline pmpsl File opened for reading /proc/859cmdline pmpsl File opened for reading /proc/13cmdline pmpsl File opened for reading /proc/33cmdline pmpsl File opened for reading /proc/811cmdline pmpsl File opened for reading /proc/815cmdline pmpsl File opened for reading /proc/853cmdline pmpsl File opened for reading /proc/7cmdline pmpsl File opened for reading /proc/8cmdline pmpsl File opened for reading /proc/17cmdline pmpsl File opened for reading /proc/855cmdline pmpsl File opened for reading /proc/20cmdline pmpsl File opened for reading /proc/23cmdline pmpsl File opened for reading /proc/867cmdline pmpsl File opened for reading /proc/19cmdline pmpsl