Analysis
- max time kernel
150s - max time network
144s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
12/10/2026, 11:48
Static task
static1
Behavioral task
behavioral1
Sample
jklmpsl.elf
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
5 signatures
150 seconds
General
- Target jklmpsl.elf
- Size 133KB
- Sample261012-nyl6msdz3n
- SHA256 cac04d2a67b7e803df096bd91bedbf5603ab09299daf7070265f27a5094637bc
- MD5 05505c4b3255435a6576654e4283c203
- SHA1 d3b4e75b00459b89246387f755df46d76e394554
- SHA512 61b1890dea2d0960a0586b63880cf16147727deaacb1497eaedc51a038ee022c235222f70cc340cc7d5d0398229f6f05084ed6acb9cce2da5578b2e297a09927
- SSDEEP 1536:9RIXh3YLB6xAp9LD6BoZOe+OSDxgmQhyofDd8b8Im35fMoO95aqyhAexG2Xt2ZMn:9WXO5ZOe+ByNz0Z81vy94Zw0IFw3xC
- TLSH T18DD31A0ABF711EBBD86FDD3342AA4B09249C190621A93F763674D81CF61B24F5AD3C64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Renames itself 1 IoCs
pid Process 803 jklmpsl.elf - Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 37.252.191.197 Destination IP 46.102.156.180 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself 803 jklmpsl.elf -
description ioc Process File opened for reading /proc/21/exe jklmpsl.elf File opened for reading /proc/22/stat jklmpsl.elf File opened for reading /proc/30/exe jklmpsl.elf File opened for reading /proc/118/exe jklmpsl.elf File opened for reading /proc/678/stat jklmpsl.elf File opened for reading /proc/841/exe jklmpsl.elf File opened for reading /proc/15/exe jklmpsl.elf File opened for reading /proc/27/stat jklmpsl.elf File opened for reading /proc/118/stat jklmpsl.elf File opened for reading /proc/369/exe jklmpsl.elf File opened for reading /proc/677/exe jklmpsl.elf File opened for reading /proc/779/stat jklmpsl.elf File opened for reading /proc/2/stat jklmpsl.elf File opened for reading /proc/22/exe jklmpsl.elf File opened for reading /proc/34/exe jklmpsl.elf File opened for reading /proc/47/stat jklmpsl.elf File opened for reading /proc/110/stat jklmpsl.elf File opened for reading /proc/136/exe jklmpsl.elf File opened for reading /proc/372/stat jklmpsl.elf File opened for reading /proc/811/stat jklmpsl.elf File opened for reading /proc/9/exe jklmpsl.elf File opened for reading /proc/17/stat jklmpsl.elf File opened for reading /proc/201/stat jklmpsl.elf File opened for reading /proc/387/stat jklmpsl.elf File opened for reading /proc/828/stat jklmpsl.elf File opened for reading /proc/6/stat jklmpsl.elf File opened for reading /proc/18/exe jklmpsl.elf File opened for reading /proc/755/stat jklmpsl.elf File opened for reading /proc/3/exe jklmpsl.elf File opened for reading /proc/35/exe jklmpsl.elf File opened for reading /proc/111/stat jklmpsl.elf File opened for reading /proc/393/stat jklmpsl.elf File opened for reading /proc/795/exe jklmpsl.elf File opened for reading /proc/798/exe jklmpsl.elf File opened for reading /proc/825/exe jklmpsl.elf File opened for reading /proc/13/exe jklmpsl.elf File opened for reading /proc/44/exe jklmpsl.elf File opened for reading /proc/59/exe jklmpsl.elf File opened for reading /proc/137/exe jklmpsl.elf File opened for reading /proc/387/exe jklmpsl.elf File opened for reading /proc/5/stat jklmpsl.elf File opened for reading /proc/13/stat jklmpsl.elf File opened for reading /proc/816/exe jklmpsl.elf File opened for reading /proc/840/exe jklmpsl.elf File opened for reading /proc/4/exe jklmpsl.elf File opened for reading /proc/14/exe jklmpsl.elf File opened for reading /proc/17/exe jklmpsl.elf File opened for reading /proc/37/stat jklmpsl.elf File opened for reading /proc/42/exe jklmpsl.elf File opened for reading /proc/774/stat jklmpsl.elf File opened for reading /proc/819/stat jklmpsl.elf File opened for reading /proc/823/stat jklmpsl.elf File opened for reading /proc/26/stat jklmpsl.elf File opened for reading /proc/58/stat jklmpsl.elf File opened for reading /proc/762/stat jklmpsl.elf File opened for reading /proc/779/exe jklmpsl.elf File opened for reading /proc/798/stat jklmpsl.elf File opened for reading /proc/807/stat jklmpsl.elf File opened for reading /proc/12/stat jklmpsl.elf File opened for reading /proc/48/exe jklmpsl.elf File opened for reading /proc/113/stat jklmpsl.elf File opened for reading /proc/755/exe jklmpsl.elf File opened for reading /proc/810/stat jklmpsl.elf File opened for reading /proc/811/exe jklmpsl.elf