Extracted

• • Target
    mpsl
  • Size 256KB
  • SHA256 661d546af82629fe989abcf66a570e568e69b91feee7509f8aede9f6362b3173
  • MD5 e72f327d705c2fdfeb2d9860e44b259f
  • SHA1 9d67727e8948b0726746ec6a065f1b24af4a1bff
  • SHA512 f08e848bdd445928a16969c682ddd52a1f578f1b5637c1635ce711471e6cad481c3775a0e33a77c6782d5782a5bc51a74ab57bbbba68c59923e739d597d52c80
  • SSDEEP 6144:cXg+6e+eVEavlfEQ3XI+SrR4qCwuNx41gh6nTZ9dXlNk:igbHcEavlfDHI+SrRRCwuL2q6ntk
  • TLSH
    T1AB44F80AAF610EFBE8AFDD3712E90B0125CCA54B22A47B357574D518F14E64B1AE3C78
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  command_and_controldefense_evasiondiscovery

  • Contacts a large (908) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Writes file to system bin folder

  behavioral1