Analysis
- max time kernel
150s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
18/10/2026, 22:40
Static task
static1
Behavioral task
behavioral1
Sample
mpsl.elf
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
5 signatures
150 seconds
General
- Target mpsl.elf
- Size 283KB
- Sample261018-2lnetswthx
- SHA256 ece8528fe3f27d206dbe159c78f315cfc191fb7415ca8cf0112086150d4120b3
- MD5 05ac136c5d0307e4599c14bc518e5a72
- SHA1 cdb51b143712e1796626767713669e6e2a39f7d1
- SHA512 24b92ac3d9dbf470d4560c93f09566087df7661a8eb893f89f8338904d65b658a2596adc1d9351bead288132ccdf8996850daa8ee66d3f2443d689c072781840
- SSDEEP 6144:qc8ZpQoNBspBwIZY0kpr1VFEetx5MwwVjj+do+aVB6Xq:v8ZpQs0tSFtrMNjj+6+U6X
- TLSH T111545B03EE404ECBF41ECDB045BDC2972EE1A5D7A5E2A539B1BC4DCDBB5A2464A834C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp mpsl.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/413/maps mpsl.elf File opened for reading /proc/29/maps mpsl.elf File opened for reading /proc/42/maps mpsl.elf File opened for reading /proc/45/maps mpsl.elf File opened for reading /proc/59/maps mpsl.elf File opened for reading /proc/399/maps mpsl.elf File opened for reading /proc/761/maps mpsl.elf File opened for reading /proc/8/maps mpsl.elf File opened for reading /proc/21/maps mpsl.elf File opened for reading /proc/27/maps mpsl.elf File opened for reading /proc/797/maps mpsl.elf File opened for reading /proc/817/maps mpsl.elf File opened for reading /proc/24/maps mpsl.elf File opened for reading /proc/380/maps mpsl.elf File opened for reading /proc/766/maps mpsl.elf File opened for reading /proc/118/maps mpsl.elf File opened for reading /proc/136/maps mpsl.elf File opened for reading /proc/137/maps mpsl.elf File opened for reading /proc/5/maps mpsl.elf File opened for reading /proc/12/maps mpsl.elf File opened for reading /proc/35/maps mpsl.elf File opened for reading /proc/4/maps mpsl.elf File opened for reading /proc/34/maps mpsl.elf File opened for reading /proc/48/maps mpsl.elf File opened for reading /proc/812/maps mpsl.elf File opened for reading /proc/11/maps mpsl.elf File opened for reading /proc/53/maps mpsl.elf File opened for reading /proc/393/maps mpsl.elf File opened for reading /proc/14/maps mpsl.elf File opened for reading /proc/47/maps mpsl.elf File opened for reading /proc/110/maps mpsl.elf File opened for reading /proc/382/maps mpsl.elf File opened for reading /proc/677/maps mpsl.elf File opened for reading /proc/7/maps mpsl.elf File opened for reading /proc/19/maps mpsl.elf File opened for reading /proc/31/maps mpsl.elf File opened for reading /proc/314/maps mpsl.elf File opened for reading /proc/333/maps mpsl.elf File opened for reading /proc/397/maps mpsl.elf File opened for reading /proc/676/maps mpsl.elf File opened for reading /proc/764/maps mpsl.elf File opened for reading /proc/2/maps mpsl.elf File opened for reading /proc/10/maps mpsl.elf File opened for reading /proc/17/maps mpsl.elf File opened for reading /proc/18/maps mpsl.elf File opened for reading /proc/26/maps mpsl.elf File opened for reading /proc/108/maps mpsl.elf File opened for reading /proc/390/maps mpsl.elf File opened for reading /proc/775/maps mpsl.elf File opened for reading /proc/20/maps mpsl.elf File opened for reading /proc/22/maps mpsl.elf File opened for reading /proc/28/maps mpsl.elf File opened for reading /proc/114/maps mpsl.elf File opened for reading /proc/707/maps mpsl.elf File opened for reading /proc/796/maps mpsl.elf File opened for reading /proc/818/maps mpsl.elf File opened for reading /proc/6/maps mpsl.elf File opened for reading /proc/9/maps mpsl.elf File opened for reading /proc/13/maps mpsl.elf File opened for reading /proc/32/maps mpsl.elf File opened for reading /proc/23/maps mpsl.elf File opened for reading /proc/37/maps mpsl.elf File opened for reading /proc/780/maps mpsl.elf File opened for reading /proc/15/maps mpsl.elf - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp mpsl.elf -
description ioc Process File opened for reading /proc/393/cmdline mpsl.elf File opened for reading /proc/2074/stat mpsl.elf File opened for reading /proc/3445/stat mpsl.elf File opened for reading /proc/3339/stat mpsl.elf File opened for reading /proc/3966/stat mpsl.elf File opened for reading /proc/435/stat mpsl.elf File opened for reading /proc/780/mounts mpsl.elf File opened for reading /proc/2254/stat mpsl.elf File opened for reading /proc/4057/stat mpsl.elf File opened for reading /proc/1282/stat mpsl.elf File opened for reading /proc/2019/stat mpsl.elf File opened for reading /proc/2165/stat mpsl.elf File opened for reading /proc/2525/stat mpsl.elf File opened for reading /proc/2756/stat mpsl.elf File opened for reading /proc/1679/stat mpsl.elf File opened for reading /proc/3398/stat mpsl.elf File opened for reading /proc/1812/stat mpsl.elf File opened for reading /proc/2618/stat mpsl.elf File opened for reading /proc/3307/stat mpsl.elf File opened for reading /proc/3367/stat mpsl.elf File opened for reading /proc/85/stat mpsl.elf File opened for reading /proc/452/stat mpsl.elf File opened for reading /proc/2591/stat mpsl.elf File opened for reading /proc/2906/stat mpsl.elf File opened for reading /proc/3203/stat mpsl.elf File opened for reading /proc/3962/stat mpsl.elf File opened for reading /proc/24/exe mpsl.elf File opened for reading /proc/45/exe mpsl.elf File opened for reading /proc/839/stat mpsl.elf File opened for reading /proc/1506/stat mpsl.elf File opened for reading /proc/3352/stat mpsl.elf File opened for reading /proc/3488/stat mpsl.elf File opened for reading /proc/45/mounts mpsl.elf File opened for reading /proc/384/stat mpsl.elf File opened for reading /proc/1797/stat mpsl.elf File opened for reading /proc/2895/stat mpsl.elf File opened for reading /proc/3266/stat mpsl.elf File opened for reading /proc/3895/stat mpsl.elf File opened for reading /proc/333/exe mpsl.elf File opened for reading /proc/350/stat mpsl.elf File opened for reading /proc/1206/stat mpsl.elf File opened for reading /proc/1277/stat mpsl.elf File opened for reading /proc/2177/stat mpsl.elf File opened for reading /proc/2197/stat mpsl.elf File opened for reading /proc/2483/stat mpsl.elf File opened for reading /proc/2693/stat mpsl.elf File opened for reading /proc/237/stat mpsl.elf File opened for reading /proc/2667/stat mpsl.elf File opened for reading /proc/8/fd mpsl.elf File opened for reading /proc/10/fd mpsl.elf File opened for reading /proc/347/stat mpsl.elf File opened for reading /proc/1949/stat mpsl.elf File opened for reading /proc/502/stat mpsl.elf File opened for reading /proc/725/stat mpsl.elf File opened for reading /proc/2467/stat mpsl.elf File opened for reading /proc/3006/stat mpsl.elf File opened for reading /proc/3387/stat mpsl.elf File opened for reading /proc/3438/stat mpsl.elf File opened for reading /proc/1499/stat mpsl.elf File opened for reading /proc/1842/stat mpsl.elf File opened for reading /proc/239/stat mpsl.elf File opened for reading /proc/1341/stat mpsl.elf File opened for reading /proc/2494/stat mpsl.elf File opened for reading /proc/1591/stat mpsl.elf