Analysis
- max time kernel
11s - max time network
10s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
23/08/2026, 06:18
Static task
static1
Behavioral task
behavioral1
Sample
sys64.mpsl
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
2 signatures
150 seconds
General
- Target sys64.mpsl
- Size 579KB
- Sample260823-g2sdhatdma
- SHA256 f3ca837ed4fc8541cbf756e8cedf19b00e94ab63feb676e2e52d0809de52e273
- MD5 e977a55cd3e329e3ed67e85508fab955
- SHA1 e8d9efd9e793e53d421e026c6f359994b1ddad14
- SHA512 e12a8af85d87d2f26c418511986f9b2562a8f863894835406bc2a8e9f6847bf3d94fcad5b7459581ece603b4e427573d0ee55efdb99178a54e72fead7f9df0b0
- SSDEEP 6144:F39uD50supbeWUO0uDbbL+pz5ZccR/8BmVvTqLbiHmkpF1hi1dcQop+mbsWOPjH:F3e52BUODyTvTaBkpFyop+QO
- TLSH T180C4F90A6F640EFBE82BCD3B06F51B12219DB45332993B767578E908BD4A50B4AD3C74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself kworker/0:0H-kblockd 803 sys64.mpsl -
description ioc Process File opened for reading /proc/3/comm sys64.mpsl File opened for reading /proc/4/comm sys64.mpsl File opened for reading /proc/5/comm sys64.mpsl File opened for reading /proc/8/comm sys64.mpsl File opened for reading /proc/34 sys64.mpsl File opened for reading /proc/36 sys64.mpsl File opened for reading /proc/21 sys64.mpsl File opened for reading /proc/25 sys64.mpsl File opened for reading /proc/26 sys64.mpsl File opened for reading /proc/28 sys64.mpsl File opened for reading /proc/6/comm sys64.mpsl File opened for reading /proc/7/comm sys64.mpsl File opened for reading /proc/20 sys64.mpsl File opened for reading /proc/23 sys64.mpsl File opened for reading /proc/27 sys64.mpsl File opened for reading /proc/29 sys64.mpsl File opened for reading /proc/30 sys64.mpsl File opened for reading /proc/31 sys64.mpsl File opened for reading /proc/32 sys64.mpsl File opened for reading /proc/33 sys64.mpsl File opened for reading /proc/22 sys64.mpsl File opened for reading /proc/24 sys64.mpsl File opened for reading /proc/35 sys64.mpsl