Overview

overview

6

Static

static

1

clean

ubuntu-18.04-amd64

6

clean

debian-9-armhf

6

clean

debian-9-mips

6

clean

debian-9-mipsel

6

Analysis

  • max time kernel
    4s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    27/05/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    clean
  • Size 795B
  • Sample260527-phcspsds9q
  • SHA256 d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e
  • MD5 SHA1 SHA512 TLSH
Score
6/10
discovery

Malware Config

Signatures

  • Attempts to change immutable files 23 IoCs

    Modifies inode attributes on the filesystem to allow changing of immutable files.

  • Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 16 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/clean
    /tmp/clean
    1⤵
    • Writes file to tmp directory
    PID:709
    • /bin/systemctl
      systemctl disable c3pool_miner
      2⤵
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:712
    • /bin/systemctl
      systemctl stop c3pool_miner
      2⤵
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:720
    • /usr/bin/chattr
      chattr -ia /var/spool/cron/crontabs
      2⤵
      • Attempts to change immutable files
      PID:723
    • /usr/bin/chattr
      chattr -ia /etc/crontab
      2⤵
      • Attempts to change immutable files
      PID:726
    • /bin/grep
      grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/crontab
      2⤵
      • Attempts to change immutable files
      PID:728
    • /bin/mv
      mv /tmp/clean_crontab /etc/crontab
      2⤵
      • Reads runtime system information
      PID:731
    • /usr/bin/chattr
      chattr -ia /etc/cron.hourly
      2⤵
      • Attempts to change immutable files
      PID:732
    • /usr/bin/chattr
      chattr -ia /etc/cron.daily
      2⤵
      • Attempts to change immutable files
      PID:733
    • /usr/bin/chattr
      chattr -ia /etc/cron.daily/apt-compat
      2⤵
      • Attempts to change immutable files
      PID:734
    • /bin/grep
      grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/apt-compat
      2⤵
      • Attempts to change immutable files
      PID:736
    • /bin/mv
      mv /tmp/clean_crontab /etc/cron.daily/apt-compat
      2⤵
      • Reads runtime system information
      PID:738
    • /usr/bin/chattr
      chattr -ia /etc/cron.daily/bsdmainutils
      2⤵
      • Attempts to change immutable files
      PID:739
    • /bin/grep
      grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/bsdmainutils
      2⤵
      • Attempts to change immutable files
      PID:740
    • /bin/mv
      mv /tmp/clean_crontab /etc/cron.daily/bsdmainutils
      2⤵
      • Reads runtime system information
      PID:742
    • /usr/bin/chattr
      chattr -ia /etc/cron.daily/dpkg
      2⤵
      • Attempts to change immutable files
      PID:745
    • /bin/grep
      grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/dpkg
      2⤵
      • Attempts to change immutable files
      PID:746
    • /bin/mv
      mv /tmp/clean_crontab /etc/cron.daily/dpkg
      2⤵
      • Reads runtime system information
      PID:747
    • /usr/bin/chattr
      chattr -ia /etc/cron.daily/exim4-base
      2⤵
      • Attempts to change immutable files
      PID:749
    • /bin/grep
      grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/exim4-base
      2⤵
      • Attempts to change immutable files
      PID:750
    • /bin/mv
      mv /tmp/clean_crontab /etc/cron.daily/exim4-base
      2⤵
      • Reads runtime system information
      PID:751
    • /usr/bin/chattr
      chattr -ia /etc/cron.daily/logrotate
      2⤵
      • Attempts to change immutable files
      PID:752
    • /bin/grep
      grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/logrotate
      2⤵
      • Attempts to change immutable files
      PID:754
    • /bin/mv
      mv /tmp/clean_crontab /etc/cron.daily/logrotate
      2⤵
      • Reads runtime system information
      PID:755
    • /usr/bin/chattr
      chattr -ia /etc/cron.daily/passwd
      2⤵
      • Attempts to change immutable files
      PID:756
    • /bin/grep
      grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/passwd
      2⤵
      • Attempts to change immutable files
      PID:757
    • /bin/mv
      mv /tmp/clean_crontab /etc/cron.daily/passwd
      2⤵
      • Reads runtime system information
      PID:758
    • /usr/bin/chattr
      chattr -ia /etc/cron.weekly
      2⤵
      • Attempts to change immutable files
      PID:759
    • /usr/bin/chattr
      chattr -ia /etc/cron.monthly
      2⤵
      • Attempts to change immutable files
      PID:760
    • /usr/bin/chattr
      chattr -ia /etc/cron.d
      2⤵
      • Attempts to change immutable files
      PID:761
    • /usr/bin/chattr
      chattr -ia /etc/anacrontab
      2⤵
      • Attempts to change immutable files
      PID:762
    • /bin/grep
      grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/anacrontab
      2⤵
      • Attempts to change immutable files
      PID:763
    • /bin/mv
      mv /tmp/clean_crontab /etc/anacrontab
      2⤵
      • Reads runtime system information
      PID:764
    • /bin/rm
      rm -rf /tmp/clean /tmp/systemd-private-4ec205c26c524b529644edf43a9d8f71-systemd-timedated.service-rSbNar
      2⤵
        PID:765
      • /bin/rm
        rm -rf /var/tmp/systemd-private-4ec205c26c524b529644edf43a9d8f71-systemd-timedated.service-IPMko9
        2⤵
        • Attempts to change immutable files
        • System Network Configuration Discovery
        PID:766
      • /bin/rm
        rm -rf "/dev/shm/*"
        2⤵
          PID:767

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            clean_crontab
            • Path /tmp/clean_crontab
            • Size 3KB
            • SHA256 a452648bb2e987dfbea6d16656f8009e641b215c69835cee79f108030be8ec7f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            clean_crontab
            • Path /tmp/clean_crontab
            • Size 722B
            • SHA256 0e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            clean_crontab
            • Path /tmp/clean_crontab
            • Size 1KB
            • SHA256 8eeae3a9df22621d51062e4dadfc5c63b49732b38a37b5d4e52c99c2237e5767
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            clean_crontab
            • Path /tmp/clean_crontab
            • Size 279B
            • SHA256 340dfc483eb79b83b0630b1c0b339e30ebd724ef2f58bb87ba92946472e8e63d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            clean_crontab
            • Path /tmp/clean_crontab
            • Size 1KB
            • SHA256 eff406c0943e1399e3e15fdb6ca2893a187d6b273f5bd9d17eec4e4b4c52b8cd
            • MD5 SHA1 SHA512 TLSH
            Submit Download