Analysis
- max time kernel
119s - max time network
155s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
20/09/2026, 04:27
Behavioral task
behavioral1
Sample
Space.mpsl.elf
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
5 signatures
150 seconds
General
- Target Space.mpsl.elf
- Size 37KB
- Sample260920-e27gbayv5k
- SHA256 28423d6534cdb6b87d6e713930926c82ce4e19f9018647809bbebc1b7be27885
- MD5 756d83d3fd7798258c101ba5fe6a1e9c
- SHA1 ffb7d6a7af93656ee1a9e806a8d3e665ca5bdd5e
- SHA512 2e3c5526c689882a4869838750eb538df42ba8642432a0bfe14d1639123daeedad07e148a9712ee445d546476c6d0349ac601cf9f7bbbfc7014eaaef765b2d45
- SSDEEP 768:CF4o5gt3IEG6Ks1mqDUKf+8hr89kxcEDV/SLXQlov0zBZLvad4mwu0zOg4zWC:El5JnsrXvrKy9QjyBZLvDmR0zOg4f
- TLSH T17F03F11AA861B09FC91F1C3F128A10AD1E90E1D6754A7B6BA365CCC5AF3684F94CC8F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
C2
-
176.65.139.206
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Space.mpsl.elf File opened for modification /dev/misc/watchdog Space.mpsl.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Space.mpsl.elf File opened for modification /bin/watchdog Space.mpsl.elf -
description ioc Process File opened for reading /proc/327/status Space.mpsl.elf File opened for reading /proc/2/status Space.mpsl.elf File opened for reading /proc/7/status Space.mpsl.elf File opened for reading /proc/12/status Space.mpsl.elf File opened for reading /proc/13/status Space.mpsl.elf File opened for reading /proc/42/status Space.mpsl.elf File opened for reading /proc/113/status Space.mpsl.elf File opened for reading /proc/181/status Space.mpsl.elf File opened for reading /proc/390/status Space.mpsl.elf File opened for reading /proc/380/status Space.mpsl.elf File opened for reading /proc/781/status Space.mpsl.elf File opened for reading /proc/790/status Space.mpsl.elf File opened for reading /proc/817/status Space.mpsl.elf File opened for reading /proc/830/status Space.mpsl.elf File opened for reading /proc/835/status Space.mpsl.elf File opened for reading /proc/16/status Space.mpsl.elf File opened for reading /proc/18/status Space.mpsl.elf File opened for reading /proc/25/status Space.mpsl.elf File opened for reading /proc/33/status Space.mpsl.elf File opened for reading /proc/48/status Space.mpsl.elf File opened for reading /proc/58/status Space.mpsl.elf File opened for reading /proc/27/status Space.mpsl.elf File opened for reading /proc/4/status Space.mpsl.elf File opened for reading /proc/6/status Space.mpsl.elf File opened for reading /proc/17/status Space.mpsl.elf File opened for reading /proc/112/status Space.mpsl.elf File opened for reading /proc/114/status Space.mpsl.elf File opened for reading /proc/678/status Space.mpsl.elf File opened for reading /proc/207/status Space.mpsl.elf File opened for reading /proc/708/status Space.mpsl.elf File opened for reading /proc/766/status Space.mpsl.elf File opened for reading /proc/5/status Space.mpsl.elf File opened for reading /proc/34/status Space.mpsl.elf File opened for reading /proc/9/status Space.mpsl.elf File opened for reading /proc/19/status Space.mpsl.elf File opened for reading /proc/31/status Space.mpsl.elf File opened for reading /proc/137/status Space.mpsl.elf File opened for reading /proc/677/status Space.mpsl.elf File opened for reading /proc/811/status Space.mpsl.elf File opened for reading /proc/1/status Space.mpsl.elf File opened for reading /proc/3/status Space.mpsl.elf File opened for reading /proc/20/status Space.mpsl.elf File opened for reading /proc/661/status Space.mpsl.elf File opened for reading /proc/21/status Space.mpsl.elf File opened for reading /proc/23/status Space.mpsl.elf File opened for reading /proc/117/status Space.mpsl.elf File opened for reading /proc/119/status Space.mpsl.elf File opened for reading /proc/346/status Space.mpsl.elf File opened for reading /proc/379/status Space.mpsl.elf File opened for reading /proc/432/status Space.mpsl.elf File opened for reading /proc/819/status Space.mpsl.elf File opened for reading /proc/14/status Space.mpsl.elf File opened for reading /proc/29/status Space.mpsl.elf File opened for reading /proc/30/status Space.mpsl.elf File opened for reading /proc/812/status Space.mpsl.elf File opened for reading /proc/818/status Space.mpsl.elf File opened for reading /proc/8/status Space.mpsl.elf File opened for reading /proc/22/status Space.mpsl.elf File opened for reading /proc/35/status Space.mpsl.elf File opened for reading /proc/395/status Space.mpsl.elf File opened for reading /proc/761/status Space.mpsl.elf File opened for reading /proc/11/status Space.mpsl.elf File opened for reading /proc/705/status Space.mpsl.elf File opened for reading /proc/837/status Space.mpsl.elf