2c72936c4a20ac9c9c118a9686fab92da2d77220e92b3a0ee4104e8b460afd28

Analysis

max time kernel
145s
max time network
151s
platform
debian-12_mipsel
resource
debian12-mipsel-20260513-en
resource tags

arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
14/08/2026, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mpsl.elf
Size 178KB
Sample260814-gamzpswtfx
SHA256 2c72936c4a20ac9c9c118a9686fab92da2d77220e92b3a0ee4104e8b460afd28
MD5 128a9253af97322d858e083d36f6d7a7
SHA1 9c000f043458bc1f96d8d09298bf54a6c83a326c
SHA512 659387ff3a2fee83fd1455304c41b4dd64eaa27b7b1d57aba5fd899159e46e80472917c232b244eec43df128ea88d3a4ad58c9e2907d25e8bbc37a788a85beb7
SSDEEP 3072:ajnDdNNaBvRSAsMt6nXt10zOYQf+izg9NXnlCGz3sUmYXw:CDdNNaTS86nXP0zOvkFYGz3sUmYXw
TLSH
T10A04F60ABF618EF7D45FCD3706BA4B0124CCE85722A9A73B7674D95CBA0A24F05D3960
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	mpsl.elf
File opened for modification	/dev/misc/watchdog	mpsl.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	eyMRNqhExuVcKeeaCi	803	mpsl.elf

/tmp/mpsl.elf
/tmp/mpsl.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
PID:803

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads