Edit tour

Linux Analysis Report
mpsl.elf

Overview

General Information

Sample name:	mpsl.elf
Analysis ID:	1583890
MD5:	a55cf93634412632eaef5ccaffd7e76e
SHA1:	2fdc889c5b539cb13ef78b4134bc538173b7cf3b
SHA256:	fb8c4375a130519b1efde83331104660d2e86beb26ea7fc0cff76eaa8ac92dcd
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Sample tries to kill multiple processes (SIGKILL)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583890
Start date and time:	2025-01-03 20:22:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	mpsl.elf
Detection:	MAL
Classification:	mal52.spre.linELF@0/22@5/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
VT rate limit hit for: mpsl.elf

Runtime Messages

Command:	/tmp/mpsl.elf
PID:	5432
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	dear
Standard Error:

Process Tree

system is lnxubuntu20

mpsl.elf (PID: 5432, Parent: 5357, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/mpsl.elf

mpsl.elf New Fork (PID: 5434, Parent: 5432)

mpsl.elf New Fork (PID: 5436, Parent: 5434)

mpsl.elf New Fork (PID: 5440, Parent: 5434)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: mpsl.elf

ReversingLabs: Detection: 28%

Source: mpsl.elf

String: '/proc/self/exe/. self/proc//bin/bash/bin/sh/bin/dashbashshftpwgettftpncnetcatnmaptcpdumpsocatcurlbusyboxpythonrebootechoinitcroniptablessshdtelnettelnetdtftpdrshdrexecdftpdxinetdpftp/bin/login

Source: global traffic	TCP traffic: 192.168.2.13:42052 -> 210.99.15.237:13566
Source: global traffic	TCP traffic: 192.168.2.13:38256 -> 210.99.63.34:13566
Source: global traffic	TCP traffic: 192.168.2.13:51534 -> 210.99.86.58:13566
Source: global traffic	TCP traffic: 192.168.2.13:42842 -> 210.99.52.116:13566
Source: global traffic	TCP traffic: 192.168.2.13:43522 -> 210.99.230.69:13566
Source: global traffic	TCP traffic: 192.168.2.13:48280 -> 210.99.79.150:13566
Source: global traffic	TCP traffic: 192.168.2.13:47898 -> 210.99.227.31:13566
Source: global traffic	TCP traffic: 192.168.2.13:35824 -> 210.99.95.136:13566
Source: global traffic	TCP traffic: 192.168.2.13:47322 -> 210.99.53.116:13566
Source: global traffic	TCP traffic: 192.168.2.13:51888 -> 210.99.217.69:13566
Source: global traffic	TCP traffic: 192.168.2.13:50514 -> 210.99.92.49:13566
Source: global traffic	TCP traffic: 192.168.2.13:45460 -> 210.99.180.166:13566
Source: global traffic	TCP traffic: 192.168.2.13:37032 -> 210.99.251.181:13566
Source: global traffic	TCP traffic: 192.168.2.13:35730 -> 210.99.182.55:13566
Source: global traffic	TCP traffic: 192.168.2.13:52276 -> 210.99.175.253:13566
Source: global traffic	TCP traffic: 192.168.2.13:41610 -> 210.99.92.190:13566
Source: global traffic	TCP traffic: 192.168.2.13:39548 -> 210.99.234.155:13566
Source: global traffic	TCP traffic: 192.168.2.13:59182 -> 210.99.224.65:13566
Source: global traffic	TCP traffic: 192.168.2.13:43662 -> 210.99.213.20:13566
Source: global traffic	TCP traffic: 192.168.2.13:46666 -> 210.99.181.187:13566
Source: global traffic	TCP traffic: 192.168.2.13:47750 -> 210.99.90.4:13566
Source: global traffic	TCP traffic: 192.168.2.13:55152 -> 210.99.81.61:13566
Source: global traffic	TCP traffic: 192.168.2.13:59252 -> 210.99.35.176:13566
Source: global traffic	TCP traffic: 192.168.2.13:33750 -> 210.99.197.88:13566
Source: global traffic	TCP traffic: 192.168.2.13:37902 -> 210.99.36.158:13566
Source: global traffic	TCP traffic: 192.168.2.13:42708 -> 83.222.191.90:13566

Source: /tmp/mpsl.elf (PID: 5432)

Socket: 127.0.0.1:8341

Jump to behavior

Source: unknown

DNS traffic detected: query: secure-network-rebirthltd.ru replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90

Source: global traffic

DNS traffic detected: DNS query: secure-network-rebirthltd.ru

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5440, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5462, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5463, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5464, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5465, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5466, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5467, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5468, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5469, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5470, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5471, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5472, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5473, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5474, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5475, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5476, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5477, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5478, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5479, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5480, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5529, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: '/proc/self/exe/. self/proc//bin/bash/bin/sh/bin/dashbashshftpwgettftpncnetcatnmaptcpdumpsocatcurlbusyboxpythonrebootechoinitcroniptablessshdtelnettelnetdtftpdrshdrexecdftpdxinetdpftp/bin/login

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5440, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5462, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5463, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5464, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5465, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5466, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5467, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5468, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5469, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5470, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5471, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5472, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5473, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5474, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5475, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5476, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5477, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5478, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5479, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5480, result: successful	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	SIGKILL sent: pid: 5529, result: successful	Jump to behavior

Source: classification engine

Classification label: mal52.spre.linELF@0/22@5/0

Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5470/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5470/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5471/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5471/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5472/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5472/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5440/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5440/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5462/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5462/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5473/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5473/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5463/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5463/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5474/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5474/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5464/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5464/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5475/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5475/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5465/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5465/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5476/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5476/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5466/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5466/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5477/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5477/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5521/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5521/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5480/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5480/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5467/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5467/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5478/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5478/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5468/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5468/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5479/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5479/cmdline	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5469/maps	Jump to behavior
Source: /tmp/mpsl.elf (PID: 5436)	File opened: /proc/5469/cmdline	Jump to behavior

Source: /tmp/mpsl.elf (PID: 5432)

Queries kernel information via 'uname':

Jump to behavior

Source: mpsl.elf, 5432.1.0000559d97cfe000.0000559d97dac000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: mpsl.elf, 5432.1.0000559d97cfe000.0000559d97dac000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: mpsl.elf, 5432.1.00007ffea54b7000.00007ffea54d8000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mpsl.elf
Source: mpsl.elf, 5432.1.00007ffea54b7000.00007ffea54d8000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mpsl.elf	29%	ReversingLabs	Linux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
secure-network-rebirthltd.ru	unknown	unknown	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
210.99.92.49	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.182.55	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.217.69	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.35.176	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.36.158	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.52.116	unknown	Korea Republic of	17841	NCIA-AS-KRNATIONALINFORMATIONRESOURCESSERVICEKR	false
210.99.53.116	unknown	Korea Republic of	17841	NCIA-AS-KRNATIONALINFORMATIONRESOURCESSERVICEKR	false
210.99.79.150	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.213.20	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.230.69	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.181.187	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.95.136	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.63.34	unknown	Korea Republic of	17841	NCIA-AS-KRNATIONALINFORMATIONRESOURCESSERVICEKR	false
210.99.86.58	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.92.190	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.90.4	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.81.61	unknown	Korea Republic of	17600	ENVICO-AS-KRKOREARESOURCESRECOVERYANDREUTILIZATIONCORP	false
210.99.175.253	unknown	Korea Republic of	45400	NICNETKoreaTelecomKR	false
83.222.191.90	unknown	Bulgaria	43561	NET1-ASBG	false
210.99.180.166	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.234.155	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.227.31	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.251.181	unknown	Korea Republic of	17841	NCIA-AS-KRNATIONALINFORMATIONRESOURCESSERVICEKR	false
210.99.197.88	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.15.237	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
210.99.224.65	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
83.222.191.90	mpsl.elf	Get hash	malicious	Unknown	Browse
	m68k.elf	Get hash	malicious	Mirai	Browse
	ppc.elf	Get hash	malicious	Mirai	Browse
	arm4.elf	Get hash	malicious	Mirai	Browse
	spc.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Mirai	Browse
	arm7.elf	Get hash	malicious	Mirai	Browse
	x86_64.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Mirai	Browse
	mips.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
KIXS-AS-KRKoreaTelecomKR	armv5l.elf	Get hash	malicious	Mirai	Browse	220.92.130.121
	armv7l.elf	Get hash	malicious	Mirai	Browse	221.161.77.61
	armv4l.elf	Get hash	malicious	Mirai	Browse	218.151.13.97
	4.elf	Get hash	malicious	Unknown	Browse	125.158.221.60
	4.elf	Get hash	malicious	Unknown	Browse	49.16.166.67
	4.elf	Get hash	malicious	Unknown	Browse	222.118.248.15
	DEMONS.arm.elf	Get hash	malicious	Unknown	Browse	211.226.202.72
	DEMONS.x86.elf	Get hash	malicious	Unknown	Browse	218.149.31.108
	DEMONS.spc.elf	Get hash	malicious	Unknown	Browse	118.37.22.221
	DEMONS.sh4.elf	Get hash	malicious	Unknown	Browse	27.236.188.110
KIXS-AS-KRKoreaTelecomKR	armv5l.elf	Get hash	malicious	Mirai	Browse	220.92.130.121
	armv7l.elf	Get hash	malicious	Mirai	Browse	221.161.77.61
	armv4l.elf	Get hash	malicious	Mirai	Browse	218.151.13.97
	4.elf	Get hash	malicious	Unknown	Browse	125.158.221.60
	4.elf	Get hash	malicious	Unknown	Browse	49.16.166.67
	4.elf	Get hash	malicious	Unknown	Browse	222.118.248.15
	DEMONS.arm.elf	Get hash	malicious	Unknown	Browse	211.226.202.72
	DEMONS.x86.elf	Get hash	malicious	Unknown	Browse	218.149.31.108
	DEMONS.spc.elf	Get hash	malicious	Unknown	Browse	118.37.22.221
	DEMONS.sh4.elf	Get hash	malicious	Unknown	Browse	27.236.188.110
KIXS-AS-KRKoreaTelecomKR	armv5l.elf	Get hash	malicious	Mirai	Browse	220.92.130.121
	armv7l.elf	Get hash	malicious	Mirai	Browse	221.161.77.61
	armv4l.elf	Get hash	malicious	Mirai	Browse	218.151.13.97
	4.elf	Get hash	malicious	Unknown	Browse	125.158.221.60
	4.elf	Get hash	malicious	Unknown	Browse	49.16.166.67
	4.elf	Get hash	malicious	Unknown	Browse	222.118.248.15
	DEMONS.arm.elf	Get hash	malicious	Unknown	Browse	211.226.202.72
	DEMONS.x86.elf	Get hash	malicious	Unknown	Browse	218.149.31.108
	DEMONS.spc.elf	Get hash	malicious	Unknown	Browse	118.37.22.221
	DEMONS.sh4.elf	Get hash	malicious	Unknown	Browse	27.236.188.110
KIXS-AS-KRKoreaTelecomKR	armv5l.elf	Get hash	malicious	Mirai	Browse	220.92.130.121
	armv7l.elf	Get hash	malicious	Mirai	Browse	221.161.77.61
	armv4l.elf	Get hash	malicious	Mirai	Browse	218.151.13.97
	4.elf	Get hash	malicious	Unknown	Browse	125.158.221.60
	4.elf	Get hash	malicious	Unknown	Browse	49.16.166.67
	4.elf	Get hash	malicious	Unknown	Browse	222.118.248.15
	DEMONS.arm.elf	Get hash	malicious	Unknown	Browse	211.226.202.72
	DEMONS.x86.elf	Get hash	malicious	Unknown	Browse	218.149.31.108
	DEMONS.spc.elf	Get hash	malicious	Unknown	Browse	118.37.22.221
	DEMONS.sh4.elf	Get hash	malicious	Unknown	Browse	27.236.188.110

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.13R9Ge (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Reputation:	low
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.3E8cWd (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Reputation:	low
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.61OMWg (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Reputation:	low
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.DUbzld (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Reputation:	low
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.GX91ie (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Reputation:	low
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.HHDAwe (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Reputation:	low
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.HQ9xEf (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Reputation:	low
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.ITEexf (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Reputation:	low
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.JquV6c (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Reputation:	low
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.S9NWVe (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Reputation:	low
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.TjLKdd (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.f2hdqg (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.gEICde (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.gTYHId (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.lfBaFd (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.n2vxad (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.qByP1f (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.qNsM7g (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.t26Bfh (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.uinPdh (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.xTDUcg (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.xYVrif (deleted)

Download File

Process:	/tmp/mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.2081404796797344
Encrypted:	false
SSDEEP:	6:UR/gceFXkBHT/VUV4ceFX8/VxD/VDM/V+4D/VH:I/9eQiVleGtMfF
MD5:	5040398A84FBBCC70318A2AFBA3CE05F
SHA1:	CCA43A0DCEA26D7CD794A3CC1358686EFDFE1697
SHA-256:	3207D97968C54E8262B92AA96B3605E5B01307FC661971736EC9EA7C06AB9098
SHA-512:	4F79B44841EEE5A82397A55C241BB9239C4C1DEACF770AB7494853E27E78A2B7BF4C21711079EA76D3F129B8564BEB8032A5D424D991E056DCBA3572C452BACD
Malicious:	false
Preview:	400000-410000 r-xp 00000000 fd:00 531567 /tmp/..450000-451000 rw-p 00010000 fd:00 531567 /tmp/..451000-452000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

Static File Info

General

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.425516181742488
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	mpsl.elf
File size:	67'912 bytes
MD5:	a55cf93634412632eaef5ccaffd7e76e
SHA1:	2fdc889c5b539cb13ef78b4134bc538173b7cf3b
SHA256:	fb8c4375a130519b1efde83331104660d2e86beb26ea7fc0cff76eaa8ac92dcd
SHA512:	9813bda35583f9b33c4d9bae139bebdc066a64896fd734e62ec1b816c5ce44bb63d884c77126ce5521f4b3a348e51b71856e8625e0755aa3c71f6ce161d9f624
SSDEEP:	1536:n0QHJ/Ri4aINWQwqyRghgb7ZsoQMYrnOAn:08nOAWQ+7yrnHn
TLSH:	F663D615BF210EB7EC6FCC3746B55B0924DC950B21A93B353934E818F26B25B1AE7874
File Content Preview:	.ELF....................`.@.4...........4. ...(...............@...@.p...p.....................E...E.....h...........Q.td...............................<l..'!......'.......................<H..'!... .........9'.. ........................<...'!.............9

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	67352
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0xf020	0x0	0x6	AX	16
.fini	PROGBITS	0x40f140	0xf140	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x40f1a0	0xf1a0	0x9d0	0x0	0x2	A	16
.ctors	PROGBITS	0x450000	0x10000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x450008	0x10008	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x450014	0x10014	0x8c	0x0	0x3	WA	4
.data	PROGBITS	0x4500a0	0x100a0	0x270	0x0	0x3	WA	16
.got	PROGBITS	0x450310	0x10310	0x3a4	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x4506b4	0x106b4	0x14	0x0	0x10000003	WAp	4
.bss	NOBITS	0x4506d0	0x106b4	0x198	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x762	0x106b4	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x106b4	0x64	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0xfb70	0xfb70	5.5117	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x10000	0x450000	0x450000	0x6b4	0x868	4.0150	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 20:22:48.698268890 CET	42052	13566	192.168.2.13	210.99.15.237
Jan 3, 2025 20:22:48.703231096 CET	13566	42052	210.99.15.237	192.168.2.13
Jan 3, 2025 20:22:48.703279018 CET	42052	13566	192.168.2.13	210.99.15.237
Jan 3, 2025 20:22:48.714443922 CET	42052	13566	192.168.2.13	210.99.15.237
Jan 3, 2025 20:22:48.719391108 CET	13566	42052	210.99.15.237	192.168.2.13
Jan 3, 2025 20:22:48.719439030 CET	42052	13566	192.168.2.13	210.99.15.237
Jan 3, 2025 20:22:48.729585886 CET	38256	13566	192.168.2.13	210.99.63.34
Jan 3, 2025 20:22:48.734757900 CET	13566	38256	210.99.63.34	192.168.2.13
Jan 3, 2025 20:22:48.734814882 CET	38256	13566	192.168.2.13	210.99.63.34
Jan 3, 2025 20:22:48.736037970 CET	38256	13566	192.168.2.13	210.99.63.34
Jan 3, 2025 20:22:48.738238096 CET	51534	13566	192.168.2.13	210.99.86.58
Jan 3, 2025 20:22:48.741107941 CET	42842	13566	192.168.2.13	210.99.52.116
Jan 3, 2025 20:22:48.742245913 CET	13566	38256	210.99.63.34	192.168.2.13
Jan 3, 2025 20:22:48.742300987 CET	38256	13566	192.168.2.13	210.99.63.34
Jan 3, 2025 20:22:48.743918896 CET	13566	51534	210.99.86.58	192.168.2.13
Jan 3, 2025 20:22:48.743973970 CET	51534	13566	192.168.2.13	210.99.86.58
Jan 3, 2025 20:22:48.747204065 CET	13566	42842	210.99.52.116	192.168.2.13
Jan 3, 2025 20:22:48.747303009 CET	42842	13566	192.168.2.13	210.99.52.116
Jan 3, 2025 20:22:48.754700899 CET	42842	13566	192.168.2.13	210.99.52.116
Jan 3, 2025 20:22:48.756634951 CET	43522	13566	192.168.2.13	210.99.230.69
Jan 3, 2025 20:22:48.760004044 CET	13566	42842	210.99.52.116	192.168.2.13
Jan 3, 2025 20:22:48.760040045 CET	42842	13566	192.168.2.13	210.99.52.116
Jan 3, 2025 20:22:48.761630058 CET	13566	43522	210.99.230.69	192.168.2.13
Jan 3, 2025 20:22:48.761673927 CET	43522	13566	192.168.2.13	210.99.230.69
Jan 3, 2025 20:22:48.769906044 CET	48280	13566	192.168.2.13	210.99.79.150
Jan 3, 2025 20:22:48.773844957 CET	47898	13566	192.168.2.13	210.99.227.31
Jan 3, 2025 20:22:48.774652004 CET	13566	48280	210.99.79.150	192.168.2.13
Jan 3, 2025 20:22:48.774703026 CET	48280	13566	192.168.2.13	210.99.79.150
Jan 3, 2025 20:22:48.778106928 CET	35824	13566	192.168.2.13	210.99.95.136
Jan 3, 2025 20:22:48.778664112 CET	13566	47898	210.99.227.31	192.168.2.13
Jan 3, 2025 20:22:48.778707027 CET	47898	13566	192.168.2.13	210.99.227.31
Jan 3, 2025 20:22:48.782109976 CET	47322	13566	192.168.2.13	210.99.53.116
Jan 3, 2025 20:22:48.782888889 CET	13566	35824	210.99.95.136	192.168.2.13
Jan 3, 2025 20:22:48.782943010 CET	35824	13566	192.168.2.13	210.99.95.136
Jan 3, 2025 20:22:48.786377907 CET	51888	13566	192.168.2.13	210.99.217.69
Jan 3, 2025 20:22:48.786827087 CET	13566	47322	210.99.53.116	192.168.2.13
Jan 3, 2025 20:22:48.786870003 CET	47322	13566	192.168.2.13	210.99.53.116
Jan 3, 2025 20:22:48.790352106 CET	50514	13566	192.168.2.13	210.99.92.49
Jan 3, 2025 20:22:48.791096926 CET	13566	51888	210.99.217.69	192.168.2.13
Jan 3, 2025 20:22:48.791138887 CET	51888	13566	192.168.2.13	210.99.217.69
Jan 3, 2025 20:22:48.795114040 CET	45460	13566	192.168.2.13	210.99.180.166
Jan 3, 2025 20:22:48.795156002 CET	13566	50514	210.99.92.49	192.168.2.13
Jan 3, 2025 20:22:48.795217991 CET	50514	13566	192.168.2.13	210.99.92.49
Jan 3, 2025 20:22:48.799595118 CET	37032	13566	192.168.2.13	210.99.251.181
Jan 3, 2025 20:22:48.799923897 CET	13566	45460	210.99.180.166	192.168.2.13
Jan 3, 2025 20:22:48.799987078 CET	45460	13566	192.168.2.13	210.99.180.166
Jan 3, 2025 20:22:48.803998947 CET	35730	13566	192.168.2.13	210.99.182.55
Jan 3, 2025 20:22:48.804382086 CET	13566	37032	210.99.251.181	192.168.2.13
Jan 3, 2025 20:22:48.804416895 CET	37032	13566	192.168.2.13	210.99.251.181
Jan 3, 2025 20:22:48.805176020 CET	52276	13566	192.168.2.13	210.99.175.253
Jan 3, 2025 20:22:48.806999922 CET	41610	13566	192.168.2.13	210.99.92.190
Jan 3, 2025 20:22:48.808587074 CET	39548	13566	192.168.2.13	210.99.234.155
Jan 3, 2025 20:22:48.808756113 CET	13566	35730	210.99.182.55	192.168.2.13
Jan 3, 2025 20:22:48.808811903 CET	35730	13566	192.168.2.13	210.99.182.55
Jan 3, 2025 20:22:48.809396982 CET	59182	13566	192.168.2.13	210.99.224.65
Jan 3, 2025 20:22:48.809925079 CET	13566	52276	210.99.175.253	192.168.2.13
Jan 3, 2025 20:22:48.809971094 CET	52276	13566	192.168.2.13	210.99.175.253
Jan 3, 2025 20:22:48.810314894 CET	43662	13566	192.168.2.13	210.99.213.20
Jan 3, 2025 20:22:48.811103106 CET	46666	13566	192.168.2.13	210.99.181.187
Jan 3, 2025 20:22:48.811748981 CET	13566	41610	210.99.92.190	192.168.2.13
Jan 3, 2025 20:22:48.811791897 CET	41610	13566	192.168.2.13	210.99.92.190
Jan 3, 2025 20:22:48.811866045 CET	47750	13566	192.168.2.13	210.99.90.4
Jan 3, 2025 20:22:48.812674999 CET	55152	13566	192.168.2.13	210.99.81.61
Jan 3, 2025 20:22:48.813352108 CET	13566	39548	210.99.234.155	192.168.2.13
Jan 3, 2025 20:22:48.813399076 CET	39548	13566	192.168.2.13	210.99.234.155
Jan 3, 2025 20:22:48.813440084 CET	59252	13566	192.168.2.13	210.99.35.176
Jan 3, 2025 20:22:48.814157963 CET	13566	59182	210.99.224.65	192.168.2.13
Jan 3, 2025 20:22:48.814201117 CET	59182	13566	192.168.2.13	210.99.224.65
Jan 3, 2025 20:22:48.814203024 CET	33750	13566	192.168.2.13	210.99.197.88
Jan 3, 2025 20:22:48.814918041 CET	37902	13566	192.168.2.13	210.99.36.158
Jan 3, 2025 20:22:48.815037966 CET	13566	43662	210.99.213.20	192.168.2.13
Jan 3, 2025 20:22:48.815078020 CET	43662	13566	192.168.2.13	210.99.213.20
Jan 3, 2025 20:22:48.815869093 CET	13566	46666	210.99.181.187	192.168.2.13
Jan 3, 2025 20:22:48.815907955 CET	46666	13566	192.168.2.13	210.99.181.187
Jan 3, 2025 20:22:48.816601038 CET	13566	47750	210.99.90.4	192.168.2.13
Jan 3, 2025 20:22:48.816637993 CET	47750	13566	192.168.2.13	210.99.90.4
Jan 3, 2025 20:22:48.817435980 CET	13566	55152	210.99.81.61	192.168.2.13
Jan 3, 2025 20:22:48.817492008 CET	55152	13566	192.168.2.13	210.99.81.61
Jan 3, 2025 20:22:48.818165064 CET	13566	59252	210.99.35.176	192.168.2.13
Jan 3, 2025 20:22:48.818209887 CET	59252	13566	192.168.2.13	210.99.35.176
Jan 3, 2025 20:22:48.818979979 CET	13566	33750	210.99.197.88	192.168.2.13
Jan 3, 2025 20:22:48.819021940 CET	33750	13566	192.168.2.13	210.99.197.88
Jan 3, 2025 20:22:48.819670916 CET	13566	37902	210.99.36.158	192.168.2.13
Jan 3, 2025 20:22:48.819710970 CET	37902	13566	192.168.2.13	210.99.36.158
Jan 3, 2025 20:22:48.860627890 CET	42708	13566	192.168.2.13	83.222.191.90
Jan 3, 2025 20:22:48.865443945 CET	13566	42708	83.222.191.90	192.168.2.13
Jan 3, 2025 20:22:48.865506887 CET	42708	13566	192.168.2.13	83.222.191.90
Jan 3, 2025 20:22:48.866564035 CET	42708	13566	192.168.2.13	83.222.191.90
Jan 3, 2025 20:22:48.871294022 CET	13566	42708	83.222.191.90	192.168.2.13
Jan 3, 2025 20:22:48.871356010 CET	42708	13566	192.168.2.13	83.222.191.90
Jan 3, 2025 20:22:48.876174927 CET	13566	42708	83.222.191.90	192.168.2.13
Jan 3, 2025 20:22:58.868851900 CET	42708	13566	192.168.2.13	83.222.191.90
Jan 3, 2025 20:22:58.873610020 CET	13566	42708	83.222.191.90	192.168.2.13
Jan 3, 2025 20:22:59.078469992 CET	13566	42708	83.222.191.90	192.168.2.13
Jan 3, 2025 20:22:59.078533888 CET	42708	13566	192.168.2.13	83.222.191.90
Jan 3, 2025 20:22:59.470439911 CET	13566	42708	83.222.191.90	192.168.2.13
Jan 3, 2025 20:22:59.470578909 CET	42708	13566	192.168.2.13	83.222.191.90
Jan 3, 2025 20:23:59.525186062 CET	42708	13566	192.168.2.13	83.222.191.90
Jan 3, 2025 20:23:59.529979944 CET	13566	42708	83.222.191.90	192.168.2.13
Jan 3, 2025 20:23:59.726475954 CET	13566	42708	83.222.191.90	192.168.2.13
Jan 3, 2025 20:23:59.726599932 CET	42708	13566	192.168.2.13	83.222.191.90
Jan 3, 2025 20:24:00.470201969 CET	13566	42708	83.222.191.90	192.168.2.13
Jan 3, 2025 20:24:00.470325947 CET	42708	13566	192.168.2.13	83.222.191.90

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 20:22:48.818862915 CET	33639	53	192.168.2.13	8.8.8.8
Jan 3, 2025 20:22:48.826653004 CET	53	33639	8.8.8.8	192.168.2.13
Jan 3, 2025 20:22:48.827888012 CET	50122	53	192.168.2.13	8.8.8.8
Jan 3, 2025 20:22:48.835627079 CET	53	50122	8.8.8.8	192.168.2.13
Jan 3, 2025 20:22:48.836572886 CET	39403	53	192.168.2.13	8.8.8.8
Jan 3, 2025 20:22:48.843707085 CET	53	39403	8.8.8.8	192.168.2.13
Jan 3, 2025 20:22:48.844641924 CET	41080	53	192.168.2.13	8.8.8.8
Jan 3, 2025 20:22:48.851865053 CET	53	41080	8.8.8.8	192.168.2.13
Jan 3, 2025 20:22:48.852897882 CET	59389	53	192.168.2.13	8.8.8.8
Jan 3, 2025 20:22:48.859848022 CET	53	59389	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 3, 2025 20:22:48.818862915 CET	192.168.2.13	8.8.8.8	0x9b2c	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Jan 3, 2025 20:22:48.827888012 CET	192.168.2.13	8.8.8.8	0x9b2c	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Jan 3, 2025 20:22:48.836572886 CET	192.168.2.13	8.8.8.8	0x9b2c	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Jan 3, 2025 20:22:48.844641924 CET	192.168.2.13	8.8.8.8	0x9b2c	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false
Jan 3, 2025 20:22:48.852897882 CET	192.168.2.13	8.8.8.8	0x9b2c	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 3, 2025 20:22:48.826653004 CET	8.8.8.8	192.168.2.13	0x9b2c	Name error (3)	secure-network-rebirthltd.ru	none	none	A (IP address)	IN (0x0001)	false
Jan 3, 2025 20:22:48.835627079 CET	8.8.8.8	192.168.2.13	0x9b2c	Name error (3)	secure-network-rebirthltd.ru	none	none	A (IP address)	IN (0x0001)	false
Jan 3, 2025 20:22:48.843707085 CET	8.8.8.8	192.168.2.13	0x9b2c	Name error (3)	secure-network-rebirthltd.ru	none	none	A (IP address)	IN (0x0001)	false
Jan 3, 2025 20:22:48.851865053 CET	8.8.8.8	192.168.2.13	0x9b2c	Name error (3)	secure-network-rebirthltd.ru	none	none	A (IP address)	IN (0x0001)	false
Jan 3, 2025 20:22:48.859848022 CET	8.8.8.8	192.168.2.13	0x9b2c	Name error (3)	secure-network-rebirthltd.ru	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: mpsl.elf PID: 5432, Parent PID: 5357

General

Start time (UTC):	19:22:48
Start date (UTC):	03/01/2025
Path:	/tmp/mpsl.elf
Arguments:	/tmp/mpsl.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Chronological Activities

Analysis Process: mpsl.elf PID: 5434, Parent PID: 5432

General

Start time (UTC):	19:22:48
Start date (UTC):	03/01/2025
Path:	/tmp/mpsl.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Chronological Activities

Analysis Process: mpsl.elf PID: 5436, Parent PID: 5434

General

Start time (UTC):	19:22:48
Start date (UTC):	03/01/2025
Path:	/tmp/mpsl.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Chronological Activities

Analysis Process: mpsl.elf PID: 5440, Parent PID: 5434

General

Start time (UTC):	19:22:48
Start date (UTC):	03/01/2025
Path:	/tmp/mpsl.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report mpsl.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.13R9Ge (deleted)

/tmp/qemu-open.3E8cWd (deleted)

/tmp/qemu-open.61OMWg (deleted)

/tmp/qemu-open.DUbzld (deleted)

/tmp/qemu-open.GX91ie (deleted)

/tmp/qemu-open.HHDAwe (deleted)

/tmp/qemu-open.HQ9xEf (deleted)

/tmp/qemu-open.ITEexf (deleted)

/tmp/qemu-open.JquV6c (deleted)

/tmp/qemu-open.S9NWVe (deleted)

/tmp/qemu-open.TjLKdd (deleted)

/tmp/qemu-open.f2hdqg (deleted)

/tmp/qemu-open.gEICde (deleted)

/tmp/qemu-open.gTYHId (deleted)

/tmp/qemu-open.lfBaFd (deleted)

/tmp/qemu-open.n2vxad (deleted)

/tmp/qemu-open.qByP1f (deleted)

/tmp/qemu-open.qNsM7g (deleted)

/tmp/qemu-open.t26Bfh (deleted)

/tmp/qemu-open.uinPdh (deleted)

/tmp/qemu-open.xTDUcg (deleted)

/tmp/qemu-open.xYVrif (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Linux Analysis Report
mpsl.elf