Extracted

• • Target
    mpsl.elf
  • Size 256KB
  • SHA256 60a9db1a5e5544f5705216f79c3995f576ceff992700f915d726ad5f12df2d6b
  • MD5 f509c905a25e136cf24b7805e7e27931
  • SHA1 c3e86dc617f5b9c56bd634e342b781fb1a300d86
  • SHA512 c4ea9c9217a984fec471cead091ab1f2318b250cb190d11245184f26a3c22508e126ce85b70f3ebc04ff354decc9af4b0c645bb3d84ff3f383262c704ecaadbf
  • SSDEEP 6144:snw+6e+eVEavlfEQ3XI+Sr546V6duhb1AR6Xj5N+Xk0k:iwbHcEavlfDHI+Sr5BV6dqp66Xwk
  • TLSH
    T1E344F80AAF610EFBE8AFDD3712E90B0125CCA54B22A47B357574D518F14E64B1AE3C78
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  command_and_controldefense_evasiondiscovery

  • Contacts a large (884) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Writes file to system bin folder

  behavioral1