Analysis
- max time kernel
150s - max time network
147s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
15/08/2026, 18:17
Static task
static1
Behavioral task
behavioral1
Sample
pmpsl
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
6 signatures
150 seconds
General
- Target pmpsl
- Size 242KB
- Sample260815-wxbmhsfk21
- SHA256 f2d84aa5b96bbfbe0d3f79a8913947949918af763bdda32c73454b0bf0065548
- MD5 f1f5da5d03b3dd7b0a634d36ac90f6a8
- SHA1 68941a3a6487cf78392111be646a2cd3b4105852
- SHA512 1d0d0b54bab7114cb510227e3b5059e50ec791aef9a93125a4ef858f86dfb4edd4d94f9e467312cfe8e0efa15dccac762a4287972332c6be2ed7e23155f4dbed
- SSDEEP 3072:9O95LHWecxKaGH5kASKYOn2jMhOY5+7lGNJuJilsEOVb:o912hLGBSpwhr5sbIl2V
- TLSH T10734F90AAB510FFBDC6BDD3702E91B0624CC641722A52F367678DA18F94A54F4AD3C78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 798 pmpsl - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog pmpsl File opened for modification /dev/misc/watchdog pmpsl - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/852/maps pmpsl File opened for reading /proc/894/maps pmpsl File opened for reading /proc/26/maps pmpsl File opened for reading /proc/28/maps pmpsl File opened for reading /proc/1/maps pmpsl File opened for reading /proc/35/maps pmpsl File opened for reading /proc/791/maps pmpsl File opened for reading /proc/794/maps pmpsl File opened for reading /proc/10/maps pmpsl File opened for reading /proc/32/maps pmpsl File opened for reading /proc/42/maps pmpsl File opened for reading /proc/845/maps pmpsl File opened for reading /proc/3/maps pmpsl File opened for reading /proc/20/maps pmpsl File opened for reading /proc/115/maps pmpsl File opened for reading /proc/136/maps pmpsl File opened for reading /proc/676/maps pmpsl File opened for reading /proc/765/maps pmpsl File opened for reading /proc/834/maps pmpsl File opened for reading /proc/4/maps pmpsl File opened for reading /proc/16/maps pmpsl File opened for reading /proc/29/maps pmpsl File opened for reading /proc/114/maps pmpsl File opened for reading /proc/201/maps pmpsl File opened for reading /proc/884/maps pmpsl File opened for reading /proc/44/maps pmpsl File opened for reading /proc/25/maps pmpsl File opened for reading /proc/5/maps pmpsl File opened for reading /proc/18/maps pmpsl File opened for reading /proc/24/maps pmpsl File opened for reading /proc/31/maps pmpsl File opened for reading /proc/33/maps pmpsl File opened for reading /proc/13/maps pmpsl File opened for reading /proc/23/maps pmpsl File opened for reading /proc/30/maps pmpsl File opened for reading /proc/47/maps pmpsl File opened for reading /proc/58/maps pmpsl File opened for reading /proc/662/maps pmpsl File opened for reading /proc/763/maps pmpsl File opened for reading /proc/790/maps pmpsl File opened for reading /proc/21/maps pmpsl File opened for reading /proc/178/maps pmpsl File opened for reading /proc/807/maps pmpsl File opened for reading /proc/7/maps pmpsl File opened for reading /proc/15/maps pmpsl File opened for reading /proc/34/maps pmpsl File opened for reading /proc/135/maps pmpsl File opened for reading /proc/344/maps pmpsl File opened for reading /proc/773/maps pmpsl File opened for reading /proc/777/maps pmpsl File opened for reading /proc/821/maps pmpsl File opened for reading /proc/17/maps pmpsl File opened for reading /proc/19/maps pmpsl File opened for reading /proc/37/maps pmpsl File opened for reading /proc/113/maps pmpsl File opened for reading /proc/400/maps pmpsl File opened for reading /proc/825/maps pmpsl File opened for reading /proc/859/maps pmpsl File opened for reading /proc/2/maps pmpsl File opened for reading /proc/8/maps pmpsl File opened for reading /proc/9/maps pmpsl File opened for reading /proc/59/maps pmpsl File opened for reading /proc/354/maps pmpsl File opened for reading /proc/707/maps pmpsl - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself scanbot 798 pmpsl -
description ioc Process File opened for reading /proc/mounts pmpsl