Analysis
- max time kernel
150s - max time network
146s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
19/10/2026, 17:53
Behavioral task
behavioral1
Sample
mpsl.elf
Resource
debian12-mipsel-20260513-en
4 signatures
150 seconds
General
- Target mpsl.elf
- Size 173KB
- Sample261019-wgdryaev91
- SHA256 76d4f71afaa6e81b07c3e634e7d2a29540179fd7e096f4bb7fd16c2272c56ea4
- MD5 9c4e7584eea8997e4415de795c2ee7b2
- SHA1 fa617eb66f2c18245b4bbb9052ca3e51f4099d91
- SHA512 9635d6c21cbee28bef47171702cf0d111fee5a8c0df64c32eef8771a4ea218391135e3b0c1d13be5de71529ce92bc68cd26461dc91562a559523029a6c07aea0
- SSDEEP 1536:cyqLYu7R4Hv5006XREaaSk2DQj4BDX06Ibr/2fwhOgSU0TziZj3YKf0Xv9MW8G/8:5qJ7S00mgTEqvSLiXyv9WG/ZFY
- TLSH T15604B616AB610FBBDCAFDD3706E9071139CCA51B22A43B393674D528F54E50B49E3CA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 804 mpsl.elf - Traces itself 2 IoCs
Traces itself to prevent debugging attempts
pid Process 804 mpsl.elf 806 mpsl.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 804 mpsl.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/mpsl.elf mpsl.elf