Overview

overview

10

Static

static

10

mpsl.elf

debian-12-mipsel

10

Analysis

  • max time kernel
    15s
  • max time network
    24s
  • platform
    debian-12_mipsel
  • resource
    debian12-mipsel-20260513-en
  • resource tags

    arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
  • submitted
    08/10/2026, 12:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    mpsl.elf
  • Size 205KB
  • Sample261008-prw8psxtet
  • SHA256 e17c2f9aadae9df7a444dbcc59fae992a1a05ddb57207c9fd23c8467fc8b23b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetdefense_evasiondiscoverymiraipersistenceprivilege_escalation

Malware Config

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Executes dropped EXE 1 IoCs
  • Creates/modifies environment variables 1 TTPs 1 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies Bash startup script 2 TTPs 1 IoCs
    persistence
  • Changes its process name 1 IoCs
  • Reads CPU attributes 1 TTPs 23 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 23 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/mpsl.elf
    /tmp/mpsl.elf
    1⤵
    • Creates/modifies environment variables
    • Modifies init.d
    • Modifies rc script
    • Modifies Bash startup script
    • Changes its process name
    PID:800
    • /bin/sh
      sh -c "/etc/init.d/magician enable 2>/dev/null"
      2⤵
      • Executes dropped EXE
      PID:803
      • /etc/init.d/magician
        /etc/init.d/magician enable
        3⤵
          PID:806
      • /bin/sh
        sh -c "chattr +i /root/.x 2>/dev/null"
        2⤵
          PID:808
          • /usr/bin/chattr
            chattr +i /root/.x
            3⤵
              PID:811
          • /bin/sh
            sh -c "chattr +i /etc/init.d/magician 2>/dev/null"
            2⤵
              PID:814
              • /usr/bin/chattr
                chattr +i /etc/init.d/magician
                3⤵
                  PID:818
              • /bin/sh
                sh -c "chattr +i /etc/rc.local 2>/dev/null"
                2⤵
                  PID:820
                  • /usr/bin/chattr
                    chattr +i /etc/rc.local
                    3⤵
                      PID:823
                  • /bin/sh
                    sh -c "pkill -9 -u daemon 2>/dev/null"
                    2⤵
                      PID:830
                      • /usr/bin/pkill
                        pkill -9 -u daemon
                        3⤵
                        • Reads CPU attributes
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:833
                    • /bin/sh
                      sh -c "pkill -9 -u bin 2>/dev/null"
                      2⤵
                        PID:844
                        • /usr/bin/pkill
                          pkill -9 -u bin
                          3⤵
                          • Reads CPU attributes
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          PID:846
                      • /bin/sh
                        sh -c "pkill -9 -u sys 2>/dev/null"
                        2⤵
                          PID:850
                          • /usr/bin/pkill
                            pkill -9 -u sys
                            3⤵
                            • Reads CPU attributes
                            • Enumerates kernel/hardware configuration
                            • Reads runtime system information
                            PID:851
                        • /bin/sh
                          sh -c "pkill -9 -u sync 2>/dev/null"
                          2⤵
                            PID:853
                            • /usr/bin/pkill
                              pkill -9 -u sync
                              3⤵
                              • Reads CPU attributes
                              • Enumerates kernel/hardware configuration
                              • Reads runtime system information
                              PID:854
                          • /bin/sh
                            sh -c "pkill -9 -u games 2>/dev/null"
                            2⤵
                              PID:856
                              • /usr/bin/pkill
                                pkill -9 -u games
                                3⤵
                                • Reads CPU attributes
                                • Enumerates kernel/hardware configuration
                                • Reads runtime system information
                                PID:858
                            • /bin/sh
                              sh -c "pkill -9 -u man 2>/dev/null"
                              2⤵
                                PID:859
                                • /usr/bin/pkill
                                  pkill -9 -u man
                                  3⤵
                                  • Reads CPU attributes
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:860
                              • /bin/sh
                                sh -c "pkill -9 -u lp 2>/dev/null"
                                2⤵
                                  PID:861
                                  • /usr/bin/pkill
                                    pkill -9 -u lp
                                    3⤵
                                    • Reads CPU attributes
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:862
                                • /bin/sh
                                  sh -c "pkill -9 -u mail 2>/dev/null"
                                  2⤵
                                    PID:863
                                    • /usr/bin/pkill
                                      pkill -9 -u mail
                                      3⤵
                                      • Reads CPU attributes
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      PID:864
                                  • /bin/sh
                                    sh -c "pkill -9 -u news 2>/dev/null"
                                    2⤵
                                      PID:865
                                      • /usr/bin/pkill
                                        pkill -9 -u news
                                        3⤵
                                        • Reads CPU attributes
                                        • Enumerates kernel/hardware configuration
                                        • Reads runtime system information
                                        PID:866
                                    • /bin/sh
                                      sh -c "pkill -9 -u uucp 2>/dev/null"
                                      2⤵
                                        PID:867
                                        • /usr/bin/pkill
                                          pkill -9 -u uucp
                                          3⤵
                                          • Reads CPU attributes
                                          • Enumerates kernel/hardware configuration
                                          • Reads runtime system information
                                          PID:868
                                      • /bin/sh
                                        sh -c "pkill -9 -u proxy 2>/dev/null"
                                        2⤵
                                          PID:869
                                          • /usr/bin/pkill
                                            pkill -9 -u proxy
                                            3⤵
                                            • Reads CPU attributes
                                            • Enumerates kernel/hardware configuration
                                            • Reads runtime system information
                                            PID:870
                                        • /bin/sh
                                          sh -c "pkill -9 -u www-data 2>/dev/null"
                                          2⤵
                                            PID:871
                                            • /usr/bin/pkill
                                              pkill -9 -u www-data
                                              3⤵
                                              • Reads CPU attributes
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:872
                                          • /bin/sh
                                            sh -c "pkill -9 -u backup 2>/dev/null"
                                            2⤵
                                              PID:873
                                              • /usr/bin/pkill
                                                pkill -9 -u backup
                                                3⤵
                                                • Reads CPU attributes
                                                • Enumerates kernel/hardware configuration
                                                • Reads runtime system information
                                                PID:874
                                            • /bin/sh
                                              sh -c "pkill -9 -u list 2>/dev/null"
                                              2⤵
                                                PID:875
                                                • /usr/bin/pkill
                                                  pkill -9 -u list
                                                  3⤵
                                                  • Reads CPU attributes
                                                  • Enumerates kernel/hardware configuration
                                                  • Reads runtime system information
                                                  PID:876
                                              • /bin/sh
                                                sh -c "pkill -9 -u irc 2>/dev/null"
                                                2⤵
                                                  PID:877
                                                  • /usr/bin/pkill
                                                    pkill -9 -u irc
                                                    3⤵
                                                    • Reads CPU attributes
                                                    • Enumerates kernel/hardware configuration
                                                    • Reads runtime system information
                                                    PID:878
                                                • /bin/sh
                                                  sh -c "pkill -9 -u _apt 2>/dev/null"
                                                  2⤵
                                                    PID:879
                                                    • /usr/bin/pkill
                                                      pkill -9 -u _apt
                                                      3⤵
                                                      • Reads CPU attributes
                                                      • Enumerates kernel/hardware configuration
                                                      • Reads runtime system information
                                                      PID:880
                                                  • /bin/sh
                                                    sh -c "pkill -9 -u nobody 2>/dev/null"
                                                    2⤵
                                                      PID:883
                                                      • /usr/bin/pkill
                                                        pkill -9 -u nobody
                                                        3⤵
                                                        • Reads CPU attributes
                                                        • Enumerates kernel/hardware configuration
                                                        • Reads runtime system information
                                                        PID:886
                                                    • /bin/sh
                                                      sh -c "pkill -9 -u systemd-network 2>/dev/null"
                                                      2⤵
                                                        PID:892
                                                        • /usr/bin/pkill
                                                          pkill -9 -u systemd-network
                                                          3⤵
                                                          • Reads CPU attributes
                                                          • Enumerates kernel/hardware configuration
                                                          • Reads runtime system information
                                                          PID:893
                                                      • /bin/sh
                                                        sh -c "pkill -9 -u Debian-exim 2>/dev/null"
                                                        2⤵
                                                          PID:896
                                                          • /usr/bin/pkill
                                                            pkill -9 -u Debian-exim
                                                            3⤵
                                                            • Reads CPU attributes
                                                            • Enumerates kernel/hardware configuration
                                                            • Reads runtime system information
                                                            PID:897
                                                        • /bin/sh
                                                          sh -c "pkill -9 -u messagebus 2>/dev/null"
                                                          2⤵
                                                            PID:900
                                                            • /usr/bin/pkill
                                                              pkill -9 -u messagebus
                                                              3⤵
                                                              • Reads CPU attributes
                                                              • Enumerates kernel/hardware configuration
                                                              • Reads runtime system information
                                                              PID:901
                                                          • /bin/sh
                                                            sh -c "pkill -9 -u sshd 2>/dev/null"
                                                            2⤵
                                                              PID:902
                                                              • /usr/bin/pkill
                                                                pkill -9 -u sshd
                                                                3⤵
                                                                • Reads CPU attributes
                                                                • Enumerates kernel/hardware configuration
                                                                • Reads runtime system information
                                                                PID:903
                                                            • /bin/sh
                                                              sh -c "pkill -9 -u polkitd 2>/dev/null"
                                                              2⤵
                                                                PID:904
                                                                • /usr/bin/pkill
                                                                  pkill -9 -u polkitd
                                                                  3⤵
                                                                  • Reads CPU attributes
                                                                  • Enumerates kernel/hardware configuration
                                                                  • Reads runtime system information
                                                                  PID:905
                                                              • /bin/sh
                                                                sh -c "pkill -9 -u user 2>/dev/null"
                                                                2⤵
                                                                  PID:906
                                                                  • /usr/bin/pkill
                                                                    pkill -9 -u user
                                                                    3⤵
                                                                    • Reads CPU attributes
                                                                    • Enumerates kernel/hardware configuration
                                                                    • Reads runtime system information
                                                                    PID:907

                                                              Network

                                                                    MITRE ATT&CK Enterprise v16

                                                                    Reconnaissance

                                                                    Resource Development

                                                                    Initial Access

                                                                    Execution

                                                                    Persistence

                                                                    Boot or Logon Autostart Execution

                                                                    3
                                                                    T1547

                                                                    Boot or Logon Initialization Scripts

                                                                    2
                                                                    T1037

                                                                    RC Scripts

                                                                    2
                                                                    T1037.004

                                                                    Event Triggered Execution

                                                                    1
                                                                    T1546

                                                                    Unix Shell Configuration Modification

                                                                    1
                                                                    T1546.004

                                                                    Hijack Execution Flow

                                                                    1
                                                                    T1574

                                                                    Path Interception by PATH Environment Variable

                                                                    1
                                                                    T1574.007

                                                                    Privilege Escalation

                                                                    Boot or Logon Autostart Execution

                                                                    3
                                                                    T1547

                                                                    Boot or Logon Initialization Scripts

                                                                    2
                                                                    T1037

                                                                    RC Scripts

                                                                    2
                                                                    T1037.004

                                                                    Event Triggered Execution

                                                                    1
                                                                    T1546

                                                                    Unix Shell Configuration Modification

                                                                    1
                                                                    T1546.004

                                                                    Hijack Execution Flow

                                                                    1
                                                                    T1574

                                                                    Path Interception by PATH Environment Variable

                                                                    1
                                                                    T1574.007

                                                                    Defense Evasion

                                                                    Hijack Execution Flow

                                                                    1
                                                                    T1574

                                                                    Path Interception by PATH Environment Variable

                                                                    1
                                                                    T1574.007

                                                                    Credential Access

                                                                    Discovery

                                                                    System Information Discovery

                                                                    2
                                                                    T1082

                                                                    Lateral Movement

                                                                    Collection

                                                                    Command and Control

                                                                    Exfiltration

                                                                    Impact

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    magician
                                                                    • Path /etc/init.d/magician
                                                                    • Size 131B
                                                                    • SHA256 0eec611c4ac2d5da4b0c945325219f644814e1339e865696cd85b9da46d3dfeb
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    rc.local
                                                                    • Path /etc/rc.local
                                                                    • Size 28B
                                                                    • SHA256 246bd5d98c6bbdc8ee0c754af983b0c73c6516a2eb4a2e8405b549d527185771
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    .x
                                                                    • Path /root/.x
                                                                    • Size 205KB
                                                                    • SHA256 e17c2f9aadae9df7a444dbcc59fae992a1a05ddb57207c9fd23c8467fc8b23b5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download