Analysis
- max time kernel
151s - max time network
155s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
27/10/2026, 13:41
Behavioral task
behavioral1
Sample
pmpsl.elf
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
4 signatures
150 seconds
General
- Target pmpsl.elf
- Size 172KB
- Sample261027-qzcpps115m
- SHA256 99b3f37563d59b908905858478bbdaf5959fc303f31688b51b33906e976bfdee
- MD5 17423550b62e3f8920ab18a5028a83eb
- SHA1 69065efaa94b2b3a8d19d1b584d5ba8c48bb6684
- SHA512 f4a862a0383e46527dad645560077c97f18673c7019ddf3cb4680ec33886b46bd02c36ead7b76c1be3f83c0bcb9d1a56a232423de208c959ad116231e2c9c93c
- SSDEEP 1536:IW1m77Y+ZYTqCBVI9cYOW9x3xdPqBZVbDrRUvkMdRkVC3W0Eli5+TrN:Iuq7PZiqCBVI9lO2xxdaZDUcMd8C8N
- TLSH T19A0451867FA13FFFD81ECD360295DA0902AC99095295AF7B2B28D508B65B10E5DD3C8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 799 pmpsl.elf - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog pmpsl.elf File opened for modification /dev/misc/watchdog pmpsl.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself vvjqlq1ilv1n2j1r 799 pmpsl.elf -
description ioc Process File opened for reading /proc/854cmdline pmpsl.elf File opened for reading /proc/11cmdline pmpsl.elf File opened for reading /proc/776cmdline pmpsl.elf File opened for reading /proc/841cmdline pmpsl.elf File opened for reading /proc/806cmdline pmpsl.elf File opened for reading /proc/830cmdline pmpsl.elf File opened for reading /proc/24cmdline pmpsl.elf File opened for reading /proc/33cmdline pmpsl.elf File opened for reading /proc/48cmdline pmpsl.elf File opened for reading /proc/802cmdline pmpsl.elf File opened for reading /proc/808cmdline pmpsl.elf File opened for reading /proc/6cmdline pmpsl.elf File opened for reading /proc/398cmdline pmpsl.elf File opened for reading /proc/676cmdline pmpsl.elf File opened for reading /proc/795cmdline pmpsl.elf File opened for reading /proc/766cmdline pmpsl.elf File opened for reading /proc/805cmdline pmpsl.elf File opened for reading /proc/809cmdline pmpsl.elf File opened for reading /proc/855cmdline pmpsl.elf File opened for reading /proc/839cmdline pmpsl.elf File opened for reading /proc/5cmdline pmpsl.elf File opened for reading /proc/53cmdline pmpsl.elf File opened for reading /proc/724cmdline pmpsl.elf File opened for reading /proc/821cmdline pmpsl.elf File opened for reading /proc/829cmdline pmpsl.elf File opened for reading /proc/840cmdline pmpsl.elf File opened for reading /proc/31cmdline pmpsl.elf File opened for reading /proc/392cmdline pmpsl.elf File opened for reading /proc/816cmdline pmpsl.elf File opened for reading /proc/817cmdline pmpsl.elf File opened for reading /proc/818cmdline pmpsl.elf File opened for reading /proc/4cmdline pmpsl.elf File opened for reading /proc/15cmdline pmpsl.elf File opened for reading /proc/37cmdline pmpsl.elf File opened for reading /proc/810cmdline pmpsl.elf File opened for reading /proc/846cmdline pmpsl.elf File opened for reading /proc/8cmdline pmpsl.elf File opened for reading /proc/9cmdline pmpsl.elf File opened for reading /proc/18cmdline pmpsl.elf File opened for reading /proc/32cmdline pmpsl.elf File opened for reading /proc/58cmdline pmpsl.elf File opened for reading /proc/59cmdline pmpsl.elf File opened for reading /proc/200cmdline pmpsl.elf File opened for reading /proc/811cmdline pmpsl.elf File opened for reading /proc/833cmdline pmpsl.elf File opened for reading /proc/16cmdline pmpsl.elf File opened for reading /proc/836cmdline pmpsl.elf File opened for reading /proc/856cmdline pmpsl.elf File opened for reading /proc/859cmdline pmpsl.elf File opened for reading /proc/30cmdline pmpsl.elf File opened for reading /proc/35cmdline pmpsl.elf File opened for reading /proc/807cmdline pmpsl.elf File opened for reading /proc/21cmdline pmpsl.elf File opened for reading /proc/378cmdline pmpsl.elf File opened for reading /proc/835cmdline pmpsl.elf File opened for reading /proc/842cmdline pmpsl.elf File opened for reading /proc/334cmdline pmpsl.elf File opened for reading /proc/661cmdline pmpsl.elf File opened for reading /proc/697cmdline pmpsl.elf File opened for reading /proc/135cmdline pmpsl.elf File opened for reading /proc/352cmdline pmpsl.elf File opened for reading /proc/112cmdline pmpsl.elf File opened for reading /proc/847cmdline pmpsl.elf File opened for reading /proc/12cmdline pmpsl.elf