Analysis
- max time kernel
151s - max time network
156s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
09/08/2026, 06:14
Behavioral task
behavioral1
Sample
nz.mpsl
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
5 signatures
150 seconds
General
- Target nz.mpsl
- Size 51KB
- Sample260809-gzd34asblh
- SHA256 f4af27bb0f0bcc102b0596a909c738fc5aa0956fed74010c0e314cac01d86323
- MD5 5d2a825a3e394b70b70666618287ce85
- SHA1 cd762c9fb07951c7047615f4c5871aac6c2295ce
- SHA512 3c122587b92281bce0047b3b86eaafbe39356f3080225ea1cb6531215a47f9283f7a3ed1fedab1f8090371b549c430722c8f16027e56c03cf3e83dcb9fc7cc3f
- SSDEEP 768:1Ta1bQa4/RakGDSXmAYxQwPSZUTJ6QcJeuoK9clGqRDPW8Jys7uWI:1Ha4pJsxQwqZUgQaoFlBPW8Jy7
- TLSH T14E33F29DE89844A5C5AC2D7E054C1F3D3264A0A8A6BDB78DC3C889CE752D5277B1B03D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
s3o65awrf56.net
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.mpsl File opened for modification /dev/misc/watchdog nz.mpsl - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.mpsl File opened for modification /bin/watchdog nz.mpsl -
description ioc Process File opened for reading /proc/764/status nz.mpsl File opened for reading /proc/7/status nz.mpsl File opened for reading /proc/27/status nz.mpsl File opened for reading /proc/33/status nz.mpsl File opened for reading /proc/37/status nz.mpsl File opened for reading /proc/48/status nz.mpsl File opened for reading /proc/112/status nz.mpsl File opened for reading /proc/21/status nz.mpsl File opened for reading /proc/28/status nz.mpsl File opened for reading /proc/29/status nz.mpsl File opened for reading /proc/35/status nz.mpsl File opened for reading /proc/180/status nz.mpsl File opened for reading /proc/379/status nz.mpsl File opened for reading /proc/796/status nz.mpsl File opened for reading /proc/805/status nz.mpsl File opened for reading /proc/45/status nz.mpsl File opened for reading /proc/58/status nz.mpsl File opened for reading /proc/677/status nz.mpsl File opened for reading /proc/806/status nz.mpsl File opened for reading /proc/19/status nz.mpsl File opened for reading /proc/34/status nz.mpsl File opened for reading /proc/114/status nz.mpsl File opened for reading /proc/793/status nz.mpsl File opened for reading /proc/18/status nz.mpsl File opened for reading /proc/26/status nz.mpsl File opened for reading /proc/59/status nz.mpsl File opened for reading /proc/377/status nz.mpsl File opened for reading /proc/802/status nz.mpsl File opened for reading /proc/403/status nz.mpsl File opened for reading /proc/766/status nz.mpsl File opened for reading /proc/5/status nz.mpsl File opened for reading /proc/6/status nz.mpsl File opened for reading /proc/17/status nz.mpsl File opened for reading /proc/30/status nz.mpsl File opened for reading /proc/119/status nz.mpsl File opened for reading /proc/722/status nz.mpsl File opened for reading /proc/3/status nz.mpsl File opened for reading /proc/8/status nz.mpsl File opened for reading /proc/14/status nz.mpsl File opened for reading /proc/16/status nz.mpsl File opened for reading /proc/20/status nz.mpsl File opened for reading /proc/408/status nz.mpsl File opened for reading /proc/663/status nz.mpsl File opened for reading /proc/777/status nz.mpsl File opened for reading /proc/15/status nz.mpsl File opened for reading /proc/47/status nz.mpsl File opened for reading /proc/111/status nz.mpsl File opened for reading /proc/137/status nz.mpsl File opened for reading /proc/431/status nz.mpsl File opened for reading /proc/678/status nz.mpsl File opened for reading /proc/22/status nz.mpsl File opened for reading /proc/32/status nz.mpsl File opened for reading /proc/138/status nz.mpsl File opened for reading /proc/202/status nz.mpsl File opened for reading /proc/390/status nz.mpsl File opened for reading /proc/795/status nz.mpsl File opened for reading /proc/115/status nz.mpsl File opened for reading /proc/380/status nz.mpsl File opened for reading /proc/387/status nz.mpsl File opened for reading /proc/23/status nz.mpsl File opened for reading /proc/4/status nz.mpsl File opened for reading /proc/13/status nz.mpsl File opened for reading /proc/31/status nz.mpsl File opened for reading /proc/53/status nz.mpsl