7bec1cbaffc69365ad9216efc4b6574ea7ed2be75d73581573d0a05c404bacb8

Analysis

max time kernel
150s
max time network
156s
platform
debian-12_mipsel
resource
debian12-mipsel-20260513-en
resource tags

arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
13/11/2026, 22:58

Target
nklmpsl.elf
Size 174KB
Sample261113-2xxsmsgx8m
SHA256 7bec1cbaffc69365ad9216efc4b6574ea7ed2be75d73581573d0a05c404bacb8
MD5 e6a7d55f6cf807d9a2ca944d0484c894
SHA1 a7c6e2bee52f0ec2f7268510e1efa5b9ded97bb3
SHA512 7558ebeebaaaf3dd053213e1a34fd18901927cc88f74f7e422ae77ce08d13e56c01207faa5a1c821aa6698f61a8b831734f8c292b3870570a9433a187d5dbf64
SSDEEP 3072:JzTYFXyiPu09f36CTSAene8QHI8DFfI6463dw+:JzTY5yiPu09yCTHeeVIcpxfd
TLSH
T143041A0ABF611EFBD8AFCD3341BA4B09298C154622B52B796574DC1CF25B24F1AD3C64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Contacts a large (7304) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Renames itself 1 IoCs

pid	Process
806	nklmpsl.elf

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself		806	nklmpsl.elf

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact